CVE-2026-49818: Apache Airflow Samba Path Traversal Flaw

CVE-2026-49818 Overview

CVE-2026-49818 is a path traversal vulnerability [CWE-22] in the Apache Airflow Samba provider. The GCSToSambaOperator joins Google Cloud Storage (GCS) object names directly to the SMB destination path without validating that the resolved path remains inside the configured destination_path. An object name containing ../ segments escapes the intended directory and writes to arbitrary locations on the Samba target. The vulnerability affects deployments where an external data producer can write objects into the source GCS bucket while a separate, trusted DAG author controls the Airflow pipeline.

Critical Impact
An attacker with write access to the source GCS bucket can write files to arbitrary paths on the Samba destination when the operator executes, potentially overwriting configuration files or planting malicious content outside the intended directory.

Affected Products

Apache Airflow Samba provider (apache-airflow-providers-samba) versions prior to 4.12.6
Apache Airflow deployments using GCSToSambaOperator to transfer files from GCS to SMB targets
Pipelines where GCS bucket write access is delegated to untrusted or external data producers

Discovery Timeline

2026-06-09 - CVE-2026-49818 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49818

Vulnerability Analysis

The GCSToSambaOperator in the Apache Airflow Samba provider transfers objects from a GCS bucket to a Samba share. During the transfer, the operator constructs the SMB write path by concatenating the configured destination_path with the GCS object name. The operator performs no containment check on the resolved path. When an object name includes ../ traversal segments, path resolution walks up the directory tree and yields a write location outside destination_path.

This is a classic directory traversal flaw where attacker-controlled input flows into a file path without canonicalization or boundary enforcement. The operator trusts that object names produced upstream are benign, but in shared-bucket architectures the producer of objects is often distinct from the DAG author who configures the destination.

Root Cause

The root cause is missing path containment validation. The fixed code in apache-airflow-providers-samba 4.12.6 resolves the joined path and verifies it remains a descendant of destination_path before writing. The vulnerable code performed the join without this check, allowing .. segments to alter the resolved destination.

Attack Vector

Exploitation requires write access to the source GCS bucket used by a GCSToSambaOperator task. The attacker uploads an object whose name contains traversal segments such as ../../etc/cron.d/payload. When the operator runs, the Samba client writes the object contents to the resolved path on the SMB target, which sits outside the configured destination directory. No interaction with the Airflow scheduler or DAG author is required beyond waiting for the scheduled transfer.

For technical details on the fix, see the Apache Airflow Pull Request 67857 and the Apache Mailing List Discussion.

Detection Methods for CVE-2026-49818

Indicators of Compromise

GCS object names containing ../ or ..\ traversal sequences in buckets consumed by Airflow Samba transfer tasks
Files written to SMB shares at paths outside the destination_path configured for GCSToSambaOperator tasks
Airflow task logs for GCSToSambaOperator showing resolved SMB paths that do not begin with the configured destination

Detection Strategies

Audit GCS bucket object listings for names containing .., leading slashes, or non-canonical path segments
Review Airflow task execution logs for GCSToSambaOperator and correlate written paths against the configured destination_path
Monitor Samba server file creation events outside directories that Airflow service accounts are expected to write to

Monitoring Recommendations

Enable SMB audit logging on Samba targets and alert on writes by Airflow service accounts outside known destination directories
Track installed versions of apache-airflow-providers-samba across Airflow workers and flag any below 4.12.6
Log GCS object create events with object name patterns and correlate against Airflow DAG run identifiers

How to Mitigate CVE-2026-49818

Immediate Actions Required

Upgrade apache-airflow-providers-samba to version 4.12.6 or later on all Airflow scheduler, worker, and triggerer nodes
Inventory all DAGs using GCSToSambaOperator and identify which source buckets accept writes from external or untrusted producers
Restrict GCS bucket write permissions to trusted identities until the upgrade is deployed

Patch Information

The maintainers fixed CVE-2026-49818 in apache-airflow-providers-samba 4.12.6. The patched operator validates that the resolved destination path stays within the configured destination_path before performing the SMB write. Apply the upgrade through the standard Airflow provider installation process and restart workers. Reference the GitHub Pull Request and the Openwall OSS Security Post for the full advisory.

Workarounds

Sanitize GCS object names before they reach the operator by adding a pre-transfer task that rejects names containing .. or absolute path separators
Replace GCSToSambaOperator with a custom operator that enforces path containment until the upgrade is applied
Apply least-privilege IAM policies on the source GCS bucket so only trusted producers can write objects consumed by Airflow

bash

# Upgrade the patched provider on Airflow workers
pip install --upgrade 'apache-airflow-providers-samba>=4.12.6'

# Verify the installed version
pip show apache-airflow-providers-samba | grep Version