Apache Airflow Experimental API Authentication Bypass

This strike exploits an authentication bypass vulnerability in Apache Airflow. The default setting for airflow's experimental API allows all API requests without authentication. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted request to apache airflow to perform malicious actions such as creating a vulnerable DAG(Directed Acyclic Graph). *NOTE: This CVE combined with CVE-2020-11978 allows vulnerable DAG creation and command injection, leading to unauthenticated remote code execution.