Description: In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--deamon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
Mitigation: Run without the `--deamon` flag via a process supervisor instead (systemd, runit, etc.). Credit: The Apache Airflow PMC would like to thank Harry Sintonen for reporting this issue.
