Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2026-94134 EUVD-2026-102521GHSA-p86c-663x-5pxq

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

Published Oct 15, 2026 · Updated Oct 16, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow SFTP provider Product: Apache Airflow SSH provider

Description

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.

Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow SSH provider < 7.0.0 7.0.0
Apache Software Foundation Apache Airflow SFTP provider < 7.0.0 7.0.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References