CVE-2026-49486

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-ftp versions prior to 3.15.1

Description The FTPSHook.get conn() function in the Apache Airflow FTP provider creates an ftplib.FTP TLS connection without calling prot p(). This results in the data channel being transmitted in cleartext, even though the control channel is TLS-protected. Consequently, deployments utilizing FTPSHook or FTPSFileTransmitOperator to transfer files over FTPS expose file contents and credentials-in-transit to network attackers capable of observing the data connection.

Recommendations Update apache-airflow-providers-ftp to version 3.15.1 or later.