CVE-2026-49818

MEDIUM EPSS 48.3%
Published Jun 9, 20263w ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Jun 9, 2026 3w ago
Last Modified Jun 17, 2026 2w ago

Description

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.

CVSS Details

Base Score
6.5
Exploitability
3.9
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
48.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
apacheapache-airflow-providers-samba* <4.12.6

References 3

  • openwall.com http://www.openwall.com/lists/oss-security/2026/06/09/8
    Mailing ListThird Party Advisory
  • github.com https://github.com/apache/airflow/pull/67857
    Issue TrackingPatch
  • lists.apache.org https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sf
    Mailing ListVendor Advisory

Remediation

  • github.com https://github.com/apache/airflow/pull/67857
    Issue TrackingPatch