A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp` to 5.8.1 or later.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let
    a malicious or compromised remote SFTP server write files outside the configured local destination
    directory via crafted directory-entry names. No Airflow account is required — the attack surface is any
    deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-providers-sftp`
    to 5.8.1 or later. (CVE-2026-50203)

ID	Name	Product	Family	Type	Severity
458174	Echo: apache-airflow-providers-sftp: security update to 5.8.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
458174	Echo: apache-airflow-providers-sftp: security update to 5.8.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
443500	SCA: security update for apache-airflow-providers-sftp (GHSA-qf38-jq28-3ccq)	Tenable Cloud Security	SCA Checks	Local	critical
443500	SCA: security update for apache-airflow-providers-sftp (GHSA-qf38-jq28-3ccq)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-50203

critical

Tenable Plugins

critical

critical

critical

critical