[CVE-2020-13927] - Insecure Default Configuration for Experimental API in Airflow < 1.10.11

[Kaxil Naik <kaxilnaik () gmail com>]

Versions Affected: <1.10.11

Description:
The previous default setting for Airflow's Experimental API was to allow
all API requests without authentication, but this
poses security risks to users who miss this fact.


> From Airflow 1.10.11 the default has been changed to deny all
requests by default and is documented at
https://airflow.apache.org/docs/1.10.11/security.html#api-authentication .

Note this change fixes it for new installs but existing users need to
change their config to default
`[api] auth_backend = airflow.api.auth.backend.deny_all` as mentioned in
the Updating Guide:

https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default


Credits:
Reported by Anonymous User