Log in / Sign up

Vulnerability details

CVE-2026-94134

Apache Software Foundation Apache Airflow SFTP providerApache Software Foundation Apache Airflow SSH provider

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

CVSS 3.1
9.1Critical

Official description

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

CVSS scores

ScoreVersionSourceVector
9.1Critical 3.1 CISA ADP / Vulnrichment (CISA-ADP) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

VendorProductVersionsSource
Apache Software Foundation Apache Airflow SFTP provider v < 7.0.0 CVEProject cvelistV5 (CNA)
Apache Software Foundation Apache Airflow SSH provider v < 7.0.0 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-10-16
Last updated
2026-10-16
State
Published
Assigner (CNA)
apache
Kolun priority
26 · Low

Exploit prediction (EPSS)

0.6%
Probability of exploitation in 30 days
48.9%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
None
Technical impact
Partial

Weaknesses (CWE)

  • CWE-322
    Key Exchange without Entity Authentication