Deferrable Code Paths Vulnerability in Apache Airflow SFTP Provider
CVE-2026-94135

4.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow Sftp Provider
Vendor
CVE Published:
15 October 2026

What is CVE-2026-94135?

The Apache Airflow SFTP provider contains a vulnerability in its deferrable code paths, specifically in SFTPTrigger, SFTPHookAsync, and SFTPClientPool, which disables SSH host-key verification by default. This behavior presents a risk when SFTP sensors or operators are executed in deferrable mode. An attacker positioned in a machine-in-the-middle scenario can exploit this issue to impersonate the SFTP server, potentially capturing sensitive credentials and exchanged data. Users are advised to upgrade to Apache Airflow Providers SFTP version 7.0.0 or later to mitigate this security risk.

Affected Version(s)

Apache Airflow SFTP provider 0 < 7.0.0

References

https://github.com/apache/airflow/pull/73419
patch
https://www.cve.org/CVERecord?id=CVE-2026-94134
related
https://lists.apache.org/thread/jbzs97t9y1zd1yp5rvxzjbx90...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude Security Scans
Igor Stepansky, OX Security
Jarek Potiuk
.