title: No Authentication on Logging Server
description: If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: Apache Airflow
vendor: Apache Software Foundation
versions:
lessThan: 2.1.2, status: affected, version: Apache Airflow, versionType: custom
}
workarounds: Use remote logging with GCS, S3, Elasticsearch etc. This is recommended for production environments.
And do not publicly expose any other ports apart from Webserver port, Flower port etc.