Jarek Potiuk

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names

Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names

Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)

Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL

Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL

Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Apache Airflow: Improper access control to DAG resources

Apache Airflow: Improper access control to DAG resources