ferralon-demo/airflow-experimental-api-rce

PoC

Security case-study: reachability analysis PoE → fix → PoNE on Apache Airflow experimental-API unauthenticated access (CVE-2020-13927), real code reconstructed at historical commits. Demo only, not for use.

view exploit source poc_in_githubauthor ferralon-demopublished 2026-07-07catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2020-13927UScritical9.8OT criticalKEV
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Ai…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan