The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was trans
The Apache Airflow FTP provider's FTPSHook.get_conn() created an ftplib.FTP_TLS connection but never called prot_p(), so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using FTPSHook or FTPSFileTransmitOperator to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to 3.15.1 or later, which issues PROT P to encrypt the data channel.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | apache-airflow-providers-ftp | < 3.15.1 | 3.15.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-49486
- https://github.com/apache/airflow/pull/67946
- https://github.com/apache/airflow/commit/a929d142d667f71dea29c565a7167216a9c30378
- https://github.com/apache/airflow
- https://github.com/apache/airflow/releases/tag/providers-ftp/3.15.1
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-ftp/PYSEC-2026-238.yaml
- https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1
- http://www.openwall.com/lists/oss-security/2026/06/26/1
- https://github.com/advisories/GHSA-fgch-86x8-fv43
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-319- Platform
- Python (PyPI)
- Package
apache-airflow-providers-ftp- Disclosed
- 26.06.2026
- Updated
- 11.10.2026 15:18
Sources and licenses
OSV / GitHub Advisory Database - GHSA-fgch-86x8-fv43 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-238 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: apache-airflow-providers-ftp
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2024 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Low 1
Disclosures per year
- 2024: 1
- 2025: 0
- 2026: 1
-
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was trans this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.