CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Apache Airflow SSH and SFTP hooks accept any server key by default, allowing machine-in-the-middle attacks.
CVE-2026-94134 affects the Apache Airflow SSH provider and SFTP provider before 7.0.0. The SSH hook disables host-key verification unless host_key is configured or no_host_key_check is explicitly false, so it accepts any server key. Default SSH and SFTP connections are affected. A machine-in-the-middle attacker could impersonate the remote host. Apache rates the flaw moderate.
- Affects Airflow SSH and SFTP providers before 7.0.0.
- Default configuration accepts any SSH server host key.
- Verification is skipped unless host_key or no_host_key_check is set.
- Machine-in-the-middle attackers can impersonate SSH or SFTP servers.
Vulnerabilities mentionedAll →
- CVE-2026-941349.1<1%Default SSH host-key check disabled in Airflow SSH/SFTPpublished · apache-airflow-providers-ssh PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-94134 | Default SSH host-key check disabled in Airflow SSH/SFTP |
Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow SSH provider before 7.0.0 - Apache Airflow SFTP provider before 7.0.0 Description: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...
This source does not provide full text. Read it at seclists.org.