Vulnerability in FTP Provider of Apache Airflow Affects Data Transmission Security

CVE-2026-49486

What is CVE-2026-49486?

The Apache Airflow FTP provider features a vulnerability wherein the FTPSHook.get_conn() method establishes an ftplib.FTP_TLS connection without invoking prot_p(). As a result, while the control channel benefits from TLS protection, the data channel transmits contents, including sensitive files and credentials, unencrypted. This flaw poses a risk for deployments utilizing FTPSHook or FTPSFileTransmitOperator for file transfers over FTPS, enabling potential interception by network attackers. To mitigate this risk, it is essential to upgrade to apache-airflow-providers-ftp version 3.15.1 or later, which ensures that the PROT P command is issued to secure the data channel.

References