Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Airflow SFTP provider

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.3
    CVE-2026-94135

    Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

    The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or o…

    Apache Software Foundation Apache Airflow SFTP provider