Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-17526

40
FAUCET Score

CVE-2020-17526 describes an incorrect session validation vulnerability in Apache Airflow Webserver versions prior to 1.10.14. This flaw allows an authenticated malicious user to bypass authorization and access an unauthorized Airflow Webserver on a different site, provided the default secret_key configuration has not been changed. The vulnerability carries a CVSS score of 7.7 (HIGH), indicating a high severity. It is a network-based attack with low complexity, requiring only low privileges, and can lead to high confidentiality impact without affecting integrity or availability. While not listed on the KEV catalog, exploit intelligence shows a Nuclei template for an "Authentication Bypass" with high severity. Community discussion and media coverage are present, suggesting some awareness, but there is no indication of active exploitation or Metasploit/ExploitDB entries.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.10.14CPE matchmatch criteria
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.7HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.1
Impact Score
4.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
23.34%
Probability of exploitation in next 30 days
EPSS Percentile
97.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Nuclei: CVE-2020-17526 · Aug 25, 2022
This CVE's current EPSS score of 0.2334 is in the 97th percentile among its peer group of 17,823 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

pippatch availablevia ghsa
Product: apache-airflowFixed in: 1.10.14

Vendor Advisories (1)

pipGHSA-7mx5-x372-xh87high

Incorrect Session Validation in Apache Airflow

Apr 20, 2021

References

lists.apache.org / thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E
lists.apache.org / thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E
Mailing ListVendor Advisory
openwall.com / lists/oss-security/2020/12/21/1
Mailing ListThird Party Advisory