Junglewise Threat Intelligence

CVE-2026-49818: Apache Airflow Samba provider path traversal in GCSToSambaOperator

CVE-2026-49818 · Severity: medium · CVSS 6.5 · Published 2026-06-09

Vendors: Apache Software Foundation, PyPI.

Executive brief

Apache Airflow is an open-source platform used to schedule and monitor complex workflows. A vulnerability in its Samba provider allows an attacker who can upload files to a source Google Cloud Storage (GCS) bucket to write files to unauthorized locations on a target Samba file share. This could lead to the overwriting of sensitive files or the placement of malicious data on corporate file servers, potentially disrupting operations or compromising data integrity.

Technical details

A path traversal vulnerability (CWE-22) exists in the `GCSToSambaOperator` within the Apache Airflow Samba provider. The `_resolve_destination_path` method joined GCS object names to the SMB destination path without proper normalization or containment checks. An attacker with write access to the source GCS bucket could use '..' path segments in object names to escape the intended `destination_path` and write files to arbitrary locations on the Samba server. The issue is resolved in version 4.12.6 by implementing path normalization and validating that the resolved path remains within the configured destination directory.

Affected products

  • Apache Software Foundation apache-airflow-providers-samba < 4.12.6

Timeline

  • 2026-06-01: patched: Pull request submitted to fix the issue.
  • 2026-06-09: disclosed: Initial advisory publication.
  • 2026-06-09: advisory

References