CVE-2020-17526

lowpriority · track · 39OT risk · elevatedEPSS 0.239 · 98 %ileEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

23.9% (98th) EPSS

CVSS 3.5 · low

Is it mine?

7 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

cvss

Technical severity, 0–10. One row per scoring source.

7.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 3.5–7.7

v2.03.5lowAV:N/AC:M/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 6.8 · impact 2.9

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.1 · impact 4

v3.17.7highAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:Fsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USCWE-269USCWE-287USCWE-798US

affected products (7)

Products and version ranges known to be affected.

Apache Software Foundation Apache AirflowApache Airflow → 1.10.14enisa_euvdEU
Apache Software Foundation Airflow≤ 1.10.14fstec_bduRU
Fortinet Inc. FortiAnalyzer6.4.0 → 6.4.7fstec_bduRU
Fortinet Inc. FortiAnalyzer7.0.0 → 7.0.2fstec_bduRU
apache airflow< 1.10.14nvdUScpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
Bitnami airflow< 1.10.14osvUSpkg:bitnami/airflow
PyPI apache-airflow< 1.10.14osvUSpkg:pypi/apache-airflow

advisories (3)

Vendor and ecosystem advisories describing this.

GHSA-7mx5-x372-xh87Incorrect Session Validation in Apache Airflow2021-04-20ghsa · osvUS
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
BIT-airflow-2020-175262024-03-06vendor · osvUS
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
PYSEC-2020-222020-12-21vendor · osvUS
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

also known as (9)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

published 2020-12-21modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan