UpHeron
All vulnerabilities

Servers and applications

CVE-2021-35936

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

Severity
Medium 5.3
Published
16 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.1.2
Sources
NVD

Affected software

SoftwareAffected versions
Apache AirflowServers and applications · cpe:a:apache:airflow
  • Every version before 2.1.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-35936
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-35936