CVE-2026-50203: Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names
A path traversal in the SFTP provider (SFTPHook.retrievedirectory / SFTPOperator(operation=get)) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade apache-airflow-providers-sftp to 5.8.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflow-providers-sftpto a version that resolves this vulnerability.Fixed in 5.8.1 - Compensating control
Restrict or avoid downloading directories from untrusted SFTP servers (limit SFTP downloads to trusted servers or network segments) until apache-airflow-providers-sftp is upgraded to 5.8.1 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50203?
CVE-2026-50203 has a critical severity score of 9.1 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-50203?
To mitigate CVE-2026-50203, update to the latest patched version of the Apache Airflow SFTP provider to address the path traversal vulnerability.
What systems are affected by CVE-2026-50203?
CVE-2026-50203 affects Apache Airflow deployments that utilize the SFTP provider, specifically the SFTPHook.retrieve_directory functionality.
What type of attack does CVE-2026-50203 enable?
CVE-2026-50203 allows an attacker to perform a path traversal attack, which can result in unauthorized file writes outside the designated directory.
Is authentication required to exploit CVE-2026-50203?
No, CVE-2026-50203 can be exploited without requiring an Airflow account, making it a significant security concern.