CVE-2026-94134: critical vulnerability in Apache Airflow SSH provider
Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.1epss 0.2%
from disclosure to weapon1 days
Published on NVDOct 15
1st PoC+1d
exploitation probability
0.2%top 93% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.
Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Apache Software Foundation · Apache Airflow SFTP providerApache Software Foundation · Apache Airflow SSH providerpublic PoCs found — 1
githubgithub.com/MosesOX/POC-CVE-2026-94134★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Airflow SSH provider
In the same product, most dangerous first.
CVE-2026-50203CRITICALApache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry namesEPSS 0.9%CVE-2026-94135MEDIUMApache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultEPSS 0.2%