CVE-2020-11978: 
Apache Airflow vulnerability analysis and mitigation

A remote code/command injection vulnerability (CVE-2020-11978) was discovered in one of the example DAGs shipped with Apache Airflow 1.10.10. The vulnerability allows any authenticated user to run arbitrary OS commands as the user running Airflow Worker/Scheduler (NVD, CISA).

The vulnerability specifically affects the example DAG named 'example_trigger_target_dag' in Apache Airflow 1.10.10. When combined with CVE-2020-13927 (a default setting that allows unauthenticated access to Airflow's Experimental REST API), these two vulnerabilities together enable unauthorized remote code execution through vulnerable DAG creation and command injection (Rapid7).

The vulnerability allows authenticated users to execute arbitrary operating system commands with the privileges of the user running the Airflow Worker/Scheduler service. When combined with CVE-2020-13927, it can lead to unauthenticated remote code execution (Rapid7).

The vulnerability has been documented in public exploit databases and can be exploited by combining it with CVE-2020-13927. The attack requires either authentication or the presence of an unauthenticated Experimental API access to be successful (Rapid7).

The vulnerability was fixed in Apache Airflow version 1.10.11. Users are advised to upgrade to this version or later to mitigate the risk (Apache Lists).