Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-94134: Apache Airflow SSH and SFTP providers accept any host key

CVE-2026-94134 · published 25 days ago

Summary

The SSH and SFTP connection tools that come with Apache Airflow do not check the server’s identity unless you specifically configure a host key or turn off the check. This means someone who can intercept the network could pretend to be the server and steal credentials or data. Update the Apache Airflow SSH and SFTP providers to version 7.0.0 or later to restore proper verification.

What to do

Update apache software foundation apache airflow ssh provider to version 7.0.0 or later.
Update apache software foundation apache airflow sftp provider to version 7.0.0 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache airflow ssh provider	< 7.0.0
apache software foundation	apache airflow sftp provider	< 7.0.0

Original advisory text

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.

Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

References

https://github.com/apache/airflow/pull/73419 patch
https://www.cve.org/CVERecord?id=CVE-2026-94135 related
https://lists.apache.org/thread/ksr1lztvd3zr74f8xd1hzch1ssl0l3lj vendor-advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94134... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-94134 Vendor Advisory
https://pypi.python.org URL

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

9.1 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-322Key Exchange without Entity Authentication

Timeline

Published15 Oct 2026

Updated7 Nov 2026

First seen15 Oct 2026

Sources

CVE-2026-94134 · NVD

CVE-2026-94134 · MITRE

CVE-2026-94134 · OSV

Track software like this

Free during beta