CVE

CVE-2020-11981

9.8

CVSS

Description

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Attack Vector

Privileges Req.

User Interaction

apache airflow

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2020-11981 Scanner

Detects 'Command Injection' vulnerability in Apache Airflow affects v. <=1.10.10

Used 3.5k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: apache airflow

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →