CVE-2026-50203: Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names

Synopsis

A path traversal vulnerability in the Apache Airflow SFTP provider allows a malicious or compromised remote SFTP server to write files outside the intended local destination directory. The attack is reachable over the network, requires no authentication on the Airflow side, and no user interaction. Successful exploitation gives an attacker the ability to read sensitive local files and overwrite arbitrary files on the Airflow worker host. A patched-image rebuild at version 5.8.1 is available on HarborGuard for environments running an affected version of the SFTP provider.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker controls or compromises a remote SFTP server that the Airflow deployment connects to over the network; exposure exists wherever the SFTP provider downloads directories from an untrusted host.

• AuthenticationNot required

  No Airflow account or credential is needed; the attack originates from the server side of the SFTP connection, not from within the Airflow platform.

• Victim interactionNot required

  No user action is required; exploitation occurs automatically whenever an Airflow task runs SFTPHook.retrieve_directory or SFTPOperator with operation=get against a malicious server.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the attacker controls the SFTP server supplying crafted directory-entry names.

Blast Radius

• The attacker writes arbitrary files to any path on the Airflow worker host filesystem that the Airflow process has permission to reach, including configuration files, credentials, and code.
• Overwriting Python modules or entrypoints on the worker enables follow-on code execution in the context of the Airflow worker process.
• Sensitive local files accessible to the Airflow worker, such as DAG source files, environment variable files, and mounted secrets, are exposed to exfiltration if the attacker can also read the directory contents back through SFTP.