CVE-2026-94134
Published:October 15, 2026
Updated:October 20, 2026
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless "host_key" is configured or "no_host_key_check" is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.
Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.
Affected Packages
apache-airflow-providers-ssh (CONDA):
Affected version(s) >=6.0.0 <7.0.0Fix Suggestion:
Update to version 7.0.0apache-airflow-providers-sftp (CONDA):
Affected version(s) >=6.0.0 <7.0.0Fix Suggestion:
Update to version 7.0.0apache-airflow-providers-sftp (PYTHON):
Affected version(s) >=6.0.0 <7.0.0Fix Suggestion:
Update to version 7.0.0apache-airflow-providers-ssh (PYTHON):
Affected version(s) >=6.0.0 <7.0.0Fix Suggestion:
Update to version 7.0.0Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Key Exchange without Entity Authentication
EPSS
Base Score:
0.30