What is the CVSS score of CVE-2026-49486?

CVE-2026-49486 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Airflow FTP Provider are affected by CVE-2026-49486?

Apache Airflow's FTP provider contains a configuration flaw that leaves sensitive file contents and authentication credentials vulnerable to network eavesdropping during FTPS transfers.. A patch is available.

How to fix or mitigate CVE-2026-49486?

24 hours: Scan environment for apache-airflow-providers-ftp installations; identify all systems running versions before 3.15.1 using package inventory tools. 7 days: Upgrade apache-airflow-providers-ftp to version 3.15.1 or later; validate functionality in staging environment before production rollout. 30 days: Confirm upgrade completion across all affected systems; review FTP/FTPS connection logs for the past 30 days to identify potential exposure events; rotate credentials used in FTP connections as a precaution.

Airflow FTP Provider CVE-2026-49486

EUVD-2026-39627 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-26 apache

GHSA-fgch-86x8-fv43

Apache Information Disclosure Apache Airflow Ftp Provider Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Attacker needs an on-path or passive position to observe the data channel, so AC:H; confidentiality-only impact (files and credentials), with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 16:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 26, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jun 26, 2026 - 16:22 NVD

7.5 (HIGH)

Source Code Evidence Fetched

Jun 26, 2026 - 08:15 vuln.today

Analysis Generated

Jun 26, 2026 - 08:15 vuln.today

DescriptionCVE.org

The Apache Airflow FTP provider's FTPSHook.get_conn() created an ftplib.FTP_TLS connection but never called prot_p(), so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using FTPSHook or FTPSFileTransmitOperator to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to 3.15.1 or later, which issues PROT P to encrypt the data channel.

Articles & Coverage 1

News 4 New Apache Vulnerabilities - 2 Critical, 2 High Severity Jun 27, 2026

AnalysisAI

Cleartext data-channel exposure in the Apache Airflow FTP provider (apache-airflow-providers-ftp before 3.15.1) lets a network attacker positioned on the data path read file contents and credentials moved over FTPS. The FTPSHook.get_conn() method established an ftplib.FTP_TLS control connection but never issued PROT P, so payloads transferred via FTPSHook or FTPSFileTransmitOperator traveled in plaintext despite the TLS-protected control channel. There is no public exploit identified at time of analysis, EPSS is very low (0.10%, 1st percentile), and it is not on CISA KEV.

Technical ContextAI

The flaw lives in Python's ftplib FTPS workflow. FTP_TLS protects the control connection automatically, but the separate data connection (used for actual file transfers and directory listings) remains in cleartext until the client explicitly calls prot_p(), which sends the PROT P command to negotiate data-channel encryption. The Airflow FTP provider's FTPSHook.get_conn() omitted this call, leaving every data transfer unencrypted. This is a textbook CWE-319 (Cleartext Transmission of Sensitive Information) root cause, confirmed by the PR diff (apache/airflow#67946) which adds self.conn.prot_p() plus a regression test asserting prot_p is called exactly once. The single affected component is cpe:2.3:a:apache_software_foundation:apache_airflow_ftp_provider.

RemediationAI

Vendor-released patch: 3.15.1 - upgrade apache-airflow-providers-ftp to 3.15.1 or later, which issues PROT P to encrypt the data channel (fix in https://github.com/apache/airflow/pull/67946 ; advisory https://lists.apache.org/thread/gwnsxlt9hfj5pc543wxtogbnjdn04xj1 ). If immediate upgrade is not possible, restrict FTPS transfers to trusted, segmented network paths (for example a private VLAN or a VPN tunnel between the Airflow worker and the FTPS server) so the cleartext data connection cannot be observed, accepting the operational overhead of maintaining those network controls; alternatively migrate the affected DAGs to SFTP via SSHHook/SFTPOperator, which encrypts the full session, noting this requires reconfiguring connections and that the remote endpoint must support SSH. Avoid moving sensitive files over FTPS until patched.