CVE-2026-94134

Summary

Apache Airflow's SSH provider hook defaults to disabling host key verification, allowing attackers to impersonate SSH servers in man-in-the-middle attacks and capture credentials or data. This affects both SSH and SFTP connections using default configurations.

Exploitability

Exploitation requires an attacker to position themselves between the Airflow worker and target SSH/SFTP server, but is relatively straightforward once achieved since the default configuration accepts any server key without verification.

Blast radius

The impact could be severe across all Airflow workflows that use SSH or SFTP connections with default configurations, potentially exposing sensitive credentials and data to attackers who can intercept these connections.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.