CVE-2026-49486: Apache Airflow FTP Provider Data Channel Encryption Vulnerability

Technical summary

CVE-2026-49486 is an incomplete TLS implementation in the Apache Airflow FTP provider. The FTPSHook.get_conn() method instantiates ftplib.FTP_TLS and negotiates TLS for the control channel, but omits the critical PROT P (Protection Level Private) command required by RFC 4217 to encrypt the data channel. Without PROT P, file data transfers occur over an unencrypted connection while the control channel remains encrypted, creating a false sense of security. The CWE-319 classification (Cleartext Transmission of Sensitive Information) reflects this asymmetric protection. An attacker with network visibility (AV:N) can passively observe data channel traffic without authentication (PR:N, UI:N) to extract file contents or credentials embedded in transfers.

Business impact

For organizations using Airflow to automate secure file transfers—particularly those moving sensitive data like financial records, personally identifiable information, or deployment artifacts—this vulnerability creates material data exposure risk. Even if your Airflow-to-FTP communication uses FTPS and appears encrypted in logs, the actual payload travels in plaintext. Credential leakage is especially critical if FTPS connection strings contain embedded usernames and passwords rather than relying on key-based auth. Compliance frameworks (PCI-DSS, HIPAA, GDPR) that mandate encryption of data in transit are violated by this pattern, potentially triggering breach notification obligations and audit findings. The fix requires only a provider upgrade and a restart of affected Airflow components.

Affected systems

Any Apache Airflow deployment using the FTP provider (apache-airflow-providers-ftp) versions prior to 3.15.1 that executes FTPSHook or FTPSFileTransmitOperator tasks is affected. This includes both on-premises and cloud-hosted Airflow instances (managed services like Astronomer, AWS MWAA, Google Cloud Composer if they vendor the FTP provider). Deployments using plain FTP (non-TLS) are not affected by this specific vulnerability but face separate plaintext transmission risks. The vulnerability is triggered only when tasks actively invoke FTPSHook.get_conn() or use FTPSFileTransmitOperator to transfer files; passive configurations where FTP hooks are defined but unused pose no direct risk.

Exploitability

This vulnerability requires no exploit code or user interaction. An attacker must be able to passively observe network traffic on the data connection path—typically the network segment between the Airflow worker and the FTP server. This is straightforward for attackers on shared network infrastructure, cloud provider networks, or compromised intermediate systems. No authentication to Airflow, the FTP server, or the targeted system is needed; the attacker simply captures packets during file transfers. The CVSS score of 7.5 (HIGH) reflects the combination of network accessibility, lack of authentication requirements, and high confidentiality impact. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, but this reflects disclosure timing rather than exploitability—the technical barrier to exploitation is extremely low.

Remediation

Upgrade apache-airflow-providers-ftp to version 3.15.1 or later, which adds the missing PROT P command to enable data channel encryption. After upgrading the package, restart all Airflow webserver, scheduler, and worker processes to load the patched code. Verify the upgrade by inspecting the installed package version and reviewing Airflow logs for any FTP connection warnings. As a compensating control pending upgrade, restrict network access to FTP servers using firewall rules and VPNs to limit the pool of potential eavesdroppers. Audit existing Airflow DAGs to confirm they use FTPS (implicit or explicit TLS) rather than plaintext FTP for sensitive transfers.

Patch guidance

The upstream fix is available in apache-airflow-providers-ftp version 3.15.1 and later. Verify your current version by running `pip show apache-airflow-providers-ftp` or checking your requirements.txt / constraints file. Update using `pip install --upgrade apache-airflow-providers-ftp>=3.15.1`. If you manage Airflow via a package manager (conda, Docker, Kubernetes Helm, or a cloud provider's managed service), follow your standard deployment process to pull the updated provider. After upgrading, rolling restart Airflow components: first the webserver (if applicable), then the scheduler, then workers. Test an FTP transfer task in a non-production environment to confirm connectivity before rolling out to production. No configuration changes to DAGs or airflow.cfg are required.

Detection guidance

Identify Airflow instances using the FTP provider by searching your environment for imports of `airflow.providers.ftp` in Python DAG files and checking pip/conda package lists for `apache-airflow-providers-ftp`. Query Airflow logs for task runs involving FTPSHook or FTPSFileTransmitOperator to understand which DAGs and schedules transfer files over FTP. If network segmentation and packet capture are available, sample traffic on the FTP data channel (typically port 20 or dynamic range) during active file transfers to confirm data is unencrypted—look for plaintext file contents in captured frames. Monitor Airflow scheduler and worker logs after upgrading to 3.15.1 to verify FTP connection health and confirm the PROT P command is being issued (check for DEBUG-level logging if enabled).

Why prioritize this

This vulnerability merits immediate attention because: (1) file transfer security is a foundational trust assumption in data pipelines, (2) the flaw is trivial to exploit passively with no authentication required, (3) the impact is direct loss of confidentiality for files and credentials in flight, and (4) the fix is non-breaking and straightforward to deploy. Organizations handling regulated or sensitive data via Airflow should prioritize this above lower-severity bugs, even if the FTP provider is not a primary data mover, because any use case that depends on FTPS for compliance creates compliance liability until patched.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: AV:N (exploitable from any network position without proximity), AC:L (no special conditions required), PR:N (no authentication needed), UI:N (no user action required), S:U (impact is scoped to the affected system), C:H (confidentiality of file data and credentials is fully compromised), I:N (integrity is not directly affected by passive eavesdropping), and A:N (availability is not impacted). The score appropriately captures the realistic risk that an attacker on the network path can extract sensitive data without any special privilege or interaction.

Frequently asked questions