CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.3. It affects Apache. It may be remotely exploitable.
CVE
CVE-2021-35936
Severity
MEDIUM
CVSS
5.3
EPSS
4.02%
Apache
Original NVD Description
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)