Threat Investigation
Request a demo

CVE-2021-35936

Medium

Description

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

SeverityMedium
CVSS5.3
Exploit probability—
ProductApache Airflow
PublishedAug 16, 2021
First seenAug 16, 2021
Weakness typeCWE-200Sensitive information exposure

How to fix

Update
  • apache airflow2.1.2 or later
  • apache-airflow2.1.2 or later

Affected products

ProductAffected versionsFixed in
apache airflowv < 2.1.22.1.2
apache-airflowPyPIv < 2.1.22.1.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.