PUBLISHED
2026-06-26 08:16
MODIFIED
2026-06-26 08:16
EPSS (Prob. Exploit)
0.44%
Top 61.5%
> DESCRIPTION
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-319: Cleartext Transmission of Sensitive Information - The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
> GITHUB SECURITY ADVISORY
GHSA-fgch-86x8-fv43
HIGH
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
AFFECTED PACKAGES:
PIP / apache-airflow-providers-ftp
< 3.15.1
Fixed in: 3.15.1
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
AFFECTED PACKAGES:
Unknown / Unknown
9518 versions affected
ALIASES:
GHSA-fgch-86x8-fv43, PYSEC-2026-238
> HISTORIQUE DES MODIFICATIONS
Première apparition
26/06/2026 08:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-319: Cleartext Transmission of Sensitive Information - The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Total des modifications: 1
Dernière mise à jour: 4 months ago