In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| apache-airflow(PyPI) | 0 | 2.3.4 | N/A |
CVSS Metrics
