The FTP provider for Apache Airflow creates an ftplib.FTP_TLS connection but never issues the PROT P command, resulting in an unencrypted data channel. This flaw, a CWE‑319 “Cleartext Transmission of Sensitive Information”, allows any file or credential transmitted over the channel to be read by an eavesdropper, compromising the confidentiality of data that passes through Airflow workflows.

Apache Airflow FTP provider, specifically deployments using FTPSHook or FTPSFileTransmitOperator with versions earlier than 3.15.1. Upgrade apache‑airflow‑providers‑ftp to 3.15.1 or later applies the missing PROT P command and encrypts the data channel.

The vulnerability could be exploited by an attacker positioned on the same network or able to passively eavesdrop on the FTPS data channel; it does not require special credentials or code execution. The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% suggests a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. Despite the low EPSS, the potential impact on confidentiality is substantial, warranting urgency in applying the vendor’s patch.