The vulnerability in Apache Airflow SFTP provider (CVE-2026-50203) involves improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the SFTPHook.retrieve_directory and SFTPOperator (operation=get) do not properly sanitize directory-entry names received from a remote SFTP server. This allows a malicious or compromised SFTP server to perform path traversal attacks, writing files outside the configured local destination directory. Exploitation requires no authentication to Airflow itself, only interaction with an untrusted SFTP server. The vulnerability affects versions of apache-airflow-providers-sftp prior to 5.8.1.

An attacker controlling or compromising a remote SFTP server can cause files to be written outside the intended local directory on the Airflow deployment. This could lead to arbitrary file overwrite or creation, potentially impacting system integrity or causing denial of service. Since no Airflow account is required, the attack surface includes any deployment that downloads directories from untrusted SFTP servers.

Upgrade the apache-airflow-providers-sftp package to version 5.8.1 or later, where this path traversal vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Patch status is confirmed by the vendor advisory stating the fix is in 5.8.1.