GitHub Advisoryadvisory · PyPI

GHSA-fgch-86x8-fv43 Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

HIGH Published 2026-06-26 Modified 2026-09-04 Official page ↗
Aliases
CVE-2026-49486
Ecosystem
PyPI
Packages
apache-airflow-providers-ftp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-319
Reviewed
2026-09-04

Affected packages

• PyPI apache-airflow-providers-ftp: < 3.15.1 → fixed in 3.15.1

Description

The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.

Related

Alias · CVE (1)

  • CVE-2026-49486 The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References