Vulnerability · Published Jun 26, 2026 · Assigned by apache
CVE-2026-49486Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
High 7.5
In plain English
A high-severity security flaw in Apache Airflow FTP provider from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow-providers-ftp | 3.15.1 | GHSA-fgch-86x8-fv43 |
| PyPI | apache-airflow-providers-ftp | 3.15.1 | PYSEC-2026-238 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow FTP provider | 0 – before 3.15.1 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N