Path Traversal Vulnerability in Apache Airflow SFTP Provider

CVE-2026-50203

What is CVE-2026-50203?

A path traversal vulnerability exists in the SFTP provider of Apache Airflow, specifically within the functions responsible for retrieving directory entries. This flaw can be exploited by a malicious remote SFTP server to manipulate files, enabling the server to write files outside the intended local destination directory. This attack is particularly concerning as it does not require a valid Airflow account, exposing any deployment that retrieves directories from an untrusted SFTP source to potential exploitation. Users are encouraged to upgrade to version 5.8.1 or later of the 'apache-airflow-providers-sftp' to mitigate this risk.

References