CVE-2026-49486

The Apache Airflow FTP provider's "FTPSHook.getconn" created an "ftplib.FTPTLS" connection but never called "protp", so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using "FTPSHook" or "FTPSFileTransmitOperator" to move files over FT...

CVE-2026-49486: Cleartext Transmission of Sensitive Information

The Apache Airflow FTP provider's FTPSHook.getconn created an ftplib.FTPTLS connection but never called protp, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using FTPSHook or FTPSFileTransmitOperator to move files over FTPS exposed...