CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Apache Airflow's async SFTP hook disables SSH host-key checks by default, enabling machine-in-the-middle attacks.
CVE-2026-94135 affects the Apache Airflow SFTP provider before 7.0.0. Deferrable paths in SFTPTrigger, SFTPHookAsync, and SFTPClientPool disable SSH host-key verification unless the connection sets no_host_key_check to false. Sensors and operators running in deferrable mode are affected. An attacker in a machine-in-the-middle position could impersonate the SFTP server. Apache rates it moderate.
40