CVE-2026-49818

The Apache Airflow Samba provider's `GCSToSambaOperator` joined GCS object names to the SMB destination path without a containment check, so an object named with `../` segments resolved a write path outside the configured `destination_path`. An attacker able to write objects into the source GCS bucket — typically an external data producer distinct from the trusted DAG author — could write files to arbitrary locations on the Samba target when the operator ran. Upgrade apache-airflow-providers-samba to 4.12.6 or later, which validates the resolved destination stays within `destination_path`.

• CWE-22

• https://github.com/apache/airflow/pull/67857Issue Tracking, Patch
• https://lists.apache.org/thread/3vs0m3p51psgf54tts18d6336g24x3sfMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/06/09/8Mailing List, Third Party Advisory

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49806Concurrent execution using shared resource with improper syn…7
• CVE-2026-49807Exposure of sensitive information to an unauthorized actor i…6.2
• CVE-2026-49808Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-49813Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…6.7
• CVE-2026-49814Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-49815Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-49819UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.…9.8
• CVE-2026-4982A user with permission "update world" in any Venueless world…7.3
• CVE-2026-49821Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49822Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49823Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49824Fission is an open-source, Kubernetes-native serverless fram…8.5