Cleartext Transmission of Sensitive Information

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the FTPSHook.getconn process not invoking protp, resulting in the data channel being...

CVE-2026-49486: Cleartext Transmission of Sensitive Information

The Apache Airflow FTP provider's FTPSHook.getconn created an ftplib.FTPTLS connection but never called protp, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using FTPSHook or FTPSFileTransmitOperator to move files over FTPS exposed...