Airflow FTP Provider CVE-2026-49486

Exploitation requires (1) a deployment running apache-airflow-providers-ftp before 3.15.1 that actually uses FTPSHook or FTPSFileTransmitOperator to move files over FTPS, and (2) an attacker able to observe the data connection - passive sniffing or an on-path/MITM position on the network route between the Airflow worker and the FTPS server. Limiting factors: only FTPS transfers are affected (plain FTP and SFTP/SSH paths are out of scope), the control channel itself remains TLS-protected, and the attacker gains nothing without network observation capability, so fully trusted and segmented transfer paths are not practically exploitable.

Signals point to a genuine but situational confidentiality risk rather than an urgent priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) treats exploitation as low-complexity network access, but CWE-319 cleartext exposure realistically requires the attacker to already hold an on-path or passive-sniffing position on the data connection, which is closer to AC:H - the published AC:L likely overstates ease of exploitation. EPSS is very low (0.10%, 1st percentile), there is no KEV listing and no public PoC, all consistent with an information-disclosure weakness that yields nothing without pre-existing network observation. Impact is confidentiality-only (no integrity or availability), so the real-world priority is moderate: meaningful where FTPS traffic crosses untrusted network segments, low where the transfer path is already trusted and segmented.

An attacker with a passive tap or man-in-the-middle position on the network segment between an Airflow worker and its FTPS server captures the data connection while a DAG runs an FTPSFileTransmitOperator task. Because PROT P was never issued, the file payloads and any credentials carried in the transfer are recorded in cleartext. No public exploit code is needed - standard packet capture suffices once the attacker is on-path, consistent with the network attack vector but real-world high complexity of obtaining that position.