CVE-2021-35936

—

CVSS 3.1

5.3 medium

EPSS

4%p90

Published

Aug 16, 2021 (Aug 16, 2021)

Modified

Jun 17, 2026

Description

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

Vendors: apache
Products: airflow
Weakness: CWE-200, CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (4.0%)

In the news0 stories

No ingested article mentions this CVE yet.