CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Apache Airflow SSH and SFTP hooks accept any server key by default, allowing machine-in-the-middle attacks.
CVE-2026-94134 affects the Apache Airflow SSH provider and SFTP provider before 7.0.0. The SSH hook disables host-key verification unless host_key is configured or no_host_key_check is explicitly false, so it accepts any server key. Default SSH and SFTP connections are affected. A machine-in-the-middle attacker could impersonate the remote host. Apache rates the flaw moderate.
42