AI analysis
The Apache Airflow SSH provider hook turns off SSH host-key verification unless host_key is set or no_host_key_check is explicitly false, so it accepts any server key. SSH and SFTP connections that rely on that default are affected; an attacker in a machine-in-the-middle position between a worker and the SSH or SFTP server can impersonate the server and capture credentials or data the task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp before 7.0.0 are affected; deferrable SFTP paths with the same default are tracked separately as CVE-2026-94135 and are also fixed in apache-airflow-providers-sftp 7.0.0. There is no known public proof of concept, the issue is not listed in CISA KEV, and exploitation in the wild is not reported.
What to do: Upgrade apache-airflow-providers-ssh and apache-airflow-providers-sftp to 7.0.0 or later. Until then, set host_key for each SSH or SFTP connection, or explicitly set no_host_key_check to false, and review tasks that send credentials or data over those connections.
Affected
| apache-airflow-providers-ssh | versions before 7.0.0 |
| apache-airflow-providers-sftp | versions before 7.0.0 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.