CVE-2026-94134
9.1CriticalPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-322
Impact
Man-in-the-middle attackers between Airflow workers and target SSH or SFTP servers can impersonate the server and steal task credentials or data. They only need network position on the path between the worker and the destination.
Root cause
The Airflow SSH provider hook disables host-key verification by default unless explicitly configured otherwise.
Affected systems
apache-airflow-providers-ssh and apache-airflow-providers-sftp prior to version 7.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade apache-airflow-providers-ssh and apache-airflow-providers-sftp to version 7.0.0 or later. If you cannot upgrade immediately, explicitly set host_key or configure no_host_key_check to false on all SSH and SFTP connections.
$ pip install --upgrade apache-airflow-providers-ssh>=7.0.0 apache-airflow-providers-sftp>=7.0.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.