Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-49486— Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

Quick assessment

Affected
Apache Software Foundation Apache Airflow FTP provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Airflow FTP是美国Apache基金会的一个FTP服务器软件。 Apache Airflow FTP 3.15.1之前版本存在加密问题漏洞，该漏洞源于FTPSHook.get_conn()创建了ftplib.FTP_TLS连接但未调用prot_p()，导致数据通道以明文传输，可能被网络攻击者观察数据连接，从而暴露传输中的文件内容和凭据。

AI Predicted 7.4 Difficulty: Trivial EPSS 0.44% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Airflow FTP provider < 3.15.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49486

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Airflow FTP 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Airflow FTP是美国Apache基金会的一个FTP服务器软件。 Apache Airflow FTP 3.15.1之前版本存在加密问题漏洞，该漏洞源于FTPSHook.get_conn()创建了ftplib.FTP_TLS连接但未调用prot_p()，导致数据通道以明文传输，可能被网络攻击者观察数据连接，从而暴露传输中的文件内容和凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Airflow FTP provider 0 ~ 3.15.1 -

II. Public POCs for CVE-2026-49486

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49486

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49486 (1)

Mailing List Discussions for CVE-2026-49486 (1)

Same Patch Batch · Apache Software Foundation · 2026-06-26 · 5 CVEs total

CVE-2026-57914 Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures
CVE-2026-57915 Apache Kerby: Kerberos Pre-Authentication Bypass
CVE-2025-55017 Apache IoTDB: Path Traversal Vulnerability
CVE-2025-64152 Apache IoTDB: Path Traversal Vulnerability

IV. Related Vulnerabilities

Same product: Apache Airflow FTP provider
Same vendor: Apache Software Foundation
Same weakness: CWE-319

V. Comments for CVE-2026-49486

No comments yet

Leave a comment