All vulnerabilities
CVE-2026-94134

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

Apache Software Foundation Apache Airflow SSH provider
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.0.0Fixed versionCVE List
Published15 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 7.0.0Apache Airflow SSH providerCVE List
  • 7.0.0Apache Airflow SFTP providerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless host_key is configured or no_host_key_check is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.

Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

Text from CVE List

Affected versions 2

  • Apache Airflow SSH provideraffected: all versions before 7.0.0CVE List
  • Apache Airflow SFTP provideraffected: all versions before 7.0.0CVE List

References 3