CVE-2021-35936: Apache Airflow

Medium severity, CVSS 5.3. EPSS: 5.5% chance of exploitation in the next 30 days.

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

Affected products

• Apache Airflow: before 2.1.2 (fixed in 2.1.2)

Published 2021-08-16. Last modified 2026-06-17.