Description
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow Google provider | < 22.0.0 | 22.0.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow-providers-google | < 22.0.0 | 22.0.0 | GHSA-g9v5-gjwf-9rwx |
Advisories 1
- WID-SEC-2026-1660 Apache Airflow (Google and FAB provider): Mehrere Schwachstellen BSI CERT-Bund (WID) · May 25, 2026