CVE-2026-49818: Apache Airflow has a Path Traversal issue
(updated )
The Apache Airflow Samba provider’s GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destination_path. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within destination_path.
References
- github.com/advisories/GHSA-f6vj-48fm-hmvx
- github.com/apache/airflow/commit/bc1df029af15cb1d35d5ca0d33bf9235500137cc
- github.com/apache/airflow/pull/67857
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-samba/PYSEC-2026-208.yaml
- lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf
- nvd.nist.gov/vuln/detail/CVE-2026-49818
Code Behaviors & Features
Detect and mitigate CVE-2026-49818 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →