2014-05-06: ADVISORY CYBERDUCK

Cyberduck (Windows versions only) accepts X.509 server certificates from any CA, also when they are not in the certificate store and not sent from the FTP server.

In a networking environment that is not trustworthy, like a wifi network, using FTP AUTH TLS with Cyberduck the server's identity can not be trusted.  

For more information on the security weakness check Micha Borrmann's advisory.