A HIGH-severity vulnerability identified as CVE-2026-49486 has been published on June 26, 2026 with a CVSS base score of 7.5. The vulnerability affects Apache Apache-airflow-providers-ftp. This security advisory provides a detailed breakdown of the vulnerability, its potential impact, weakness classification, and actionable steps to protect your systems.
Vulnerability Details
CVE ID: CVE-2026-49486
Severity: HIGH
CVSS Score: 7.5
Published: June 26, 2026
Affected Product: Apache Apache-airflow-providers-ftp
Weakness (CWE): CWE-319
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality Impact | High |
| Integrity Impact | None |
| Availability Impact | None |
Technical Description
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
Potential Impact
If exploited, this high-severity vulnerability could allow an attacker to compromise sensitive data confidentiality. Organizations running Apache Apache-airflow-providers-ftp should treat this as a priority remediation item.
Recommended Action
A patch or vendor advisory is available. Take the following steps immediately:
- Review the vendor advisory linked in the References section below.
- Identify all instances of the affected software in your environment.
- Apply the available patch or upgrade to the fixed version as soon as possible.
- If patching is not immediately possible, implement compensating controls such as WAF rules, network segmentation, or disabling the affected feature.
- Monitor your systems for signs of exploitation using your SIEM or IDS/IPS.
References
Related Security Advisories
- [HIGH] CVE-2026-57872 — CVSS 7.5 (June 26, 2026) — HIGH / CVSS 7.5
- [HIGH] CVE-2026-12937 — CVSS 7.5 (June 25, 2026) — HIGH / CVSS 7.5
- [HIGH] CVE-2025-66336 — CVSS 8.1 (June 22, 2026) — HIGH / CVSS 8.1
![[HIGH] CVE-2026-13126 — CVSS 7.8 (July 8, 2026)](https://atlas-cybersecurity.com/wp-content/plugins/elementor/assets/images/placeholder.png)
