CVE-2021-35936: Missing Authorization in Apache Airflow
Summary
CVE-2021-35936: Missing Authorization in Apache Airflow. Affects apache-airflow versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-35936 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing complex data pipelines. However, versions prior to 2.1.2 are vulnerable to a missing authorization issue.
Vulnerability Detail
The vulnerability arises when remote logging is not used in Apache Airflow. In such cases, the worker (CeleryExecutor) or the scheduler (LocalExecutor) runs a Flask logging server that listens on a specific port and binds to 0.0.0.0 by default. This logging server lacks authentication, allowing unauthorized access to read log files of DAG jobs. This vulnerability can be exploited by an attacker to gain sensitive information from the log files. The issue has been assigned a CVSS score of 5.3, indicating a moderate severity.
How To Fix
Latest published version: 3.3.2 as of 22 Oct 2026
pip install --upgrade "apache-airflow==3.3.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
pip install --upgrade "apache-airflow==2.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to enable remote logging in Apache Airflow. By configuring remote logging, the Flask logging server is not started, eliminating the vulnerability. Here's an example of how to enable remote logging in the airflow.cfg file:
[core] remote_logging = True remote_log_conn_id = <your_remote_logging_connection_id>
Please note that this workaround may impact the logging functionality and should be considered as a temporary solution until the upgrade can be performed.
Conclusion
In conclusion, Apache Airflow versions prior to 2.1.2 are vulnerable to a missing authorization issue that allows unauthorized access to log files of DAG jobs. To mitigate this vulnerability, it is recommended to upgrade to the latest version of Apache Airflow. If immediate upgrade is not feasible, enabling remote logging can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing complex data pipelines.
The vulnerability allows unauthorized access to read log files of DAG jobs in Apache Airflow. This can potentially expose sensitive information and compromise the security of the system.
To fix this vulnerability, it is recommended to upgrade to Apache Airflow version 2.1.2 or later. This version includes the necessary authentication mechanisms to secure the logging server.
Yes, a temporary workaround is to enable remote logging in Apache Airflow. By configuring remote logging, the Flask logging server is not started, eliminating the vulnerability. However, this workaround may impact the logging functionality and should be considered as a temporary solution until the upgrade can be performed.
The vulnerability has been assigned a CVSS score of 5.3, indicating a moderate severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow.
