Skip to content
OpenAdvisories

Weakness (CWE)

CWE-322: Key Exchange without Entity Authentication

Base Draft

The product performs a key exchange with an actor without verifying the identity of that actor.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Ensure that proper authentication is included in the system design.

  2. Implementation

    Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Source: MITRE CWE-322

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-94134 Public exploit

    Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

    The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. A…

    Apache Software Foundation Apache Airflow SFTP provider Apache Airflow SSH provider