Airflow SFTP provider: malicious remote server writes files outside the local destination directory

Impact

When an Airflow task pulls a directory from an SFTP server, crafted directory-entry names let the remote side escape the configured local destination and write anywhere the worker process can write. The attacker here is the remote server, so the exposure is any DAG that fetches directories from a host the operator does not fully control. On a fleet, Airflow workers commonly share a mounted scratch or dataset path and run with pipeline credentials, so a write-anywhere primitive reaches DAG files, SSH keys and config under the worker's identity - which becomes code execution the next time the written file is loaded. No Airflow account is needed.

Who can reach it

Operator of the remote SFTP server a DAG downloads from, or anyone who has compromised it. No Airflow authentication required - the attack arrives through data the pipeline was told to fetch.

What to do

Upgrade apache-airflow-providers-sftp to 5.8.1 or later and restart the workers and scheduler; this is a Python package bump, not a host change. Until then, avoid SFTPOperator(operation=get) against directories on untrusted servers and review worker-writable paths for unexpected files.

References

Related entries

• NVIDIA AIStore: token-revocation endpoint accepts unauthenticated revocation listsCVE-2026-65173 · NVIDIA AIStore (token-revocation endpoint)Critical
• Apache Airflow FAB provider: Azure AD id_token issuer and audience unchecked, any tenant can log inCVE-2026-75156 · Apache Airflow FAB provider (Azure AD OAuth id_token issuer/audience validation)Critical
• Airflow Keycloak provider: Keycloak tokens from unsigned cookies are not bound to the session identityCVE-2026-76186 · Apache Airflow Keycloak provider (session identity vs. Keycloak access/refresh token binding)Critical
• Fortra BoKS Manager: command injection in crlserver gives root on the BoKS Master via a crafted CRL URLCVE-2026-79898 · Fortra BoKS Manager crlserver (CRL URL handling)Critical
• Airflow FAB provider: password change through the Admin PATCH endpoint does not evict existing sessionsCVE-2026-86462 · Apache Airflow FAB provider (Admin user-edit PATCH endpoint, session invalidation)Critical
• Apache Airflow: Core API logout does not revoke bearer tokens, so a stolen token outlives the sessionCVE-2026-86473 · Apache Airflow Core API (logout endpoint, bearer-token revocation)Critical