SSH Host-Key Verification Bypass in Apache Airflow Provider

CVE-2026-94134

What is CVE-2026-94134?

The Apache Airflow SSH provider hook presents a significant security flaw by disabling SSH host-key verification by default. When the host_key configuration is absent or if no_host_key_check is set to true, the system accepts any server key without validation. This vulnerability exposes SSH and SFTP connections to potential man-in-the-middle attacks, wherein an attacker can impersonate the SSH or SFTP server, compromising sensitive credentials and data transmitted in specific tasks. Users are strongly advised to upgrade to apache-airflow-providers-ssh and apache-airflow-providers-sftp version 7.0.0 or higher to mitigate this risk. This fix addresses not only the SSH issues but also impacts the deferrable SFTP code paths, which are related but covered under a separate CVE.

References