Apache Apache-Airflow-Providers-FTP vulnerabilities

2 CVEs affecting Apache Apache-Airflow-Providers-FTP, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-49486, published 2026-06-26.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-29733, published 2024-04-21. Low severity, CVSS 2.7. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged.…
• CVE-2026-49486, published 2026-06-26. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was…