Apache Airflow Git Provider SSH Host Key Verification Bypass

Executive Summary

CVE-2026-58065 is a vulnerability in the Apache Airflow Git provider (apache-airflow-providers-git) that affects versions prior to 0.4.1. By default, the provider disables SSH host-key verification by setting `StrictHostKeyChecking=no` during Git-over-SSH operations. This means that when Airflow workers connect to a Git server, they do not verify the server's host key, making it possible for an attacker to impersonate the Git server.

An attacker who can intercept the network path between the Airflow worker and the Git server (a man-in-the-middle attack) can exploit this vulnerability to capture SSH deploy keys or inject malicious content into the repository. This affects deployments that use the Git DAG bundle or Git provider to clone repositories over SSH with a deploy key.

The fix involves upgrading to version 0.4.1 or later of the Git provider and configuring a `known_hosts` file to enable host-key verification. This ensures that SSH connections are validated, preventing unauthorized access or tampering.

Useful 0 Not Useful 0

Detection Guidance

To detect whether your Apache Airflow Git provider is vulnerable to CVE-2026-58065, you can check the following:

• Verify the version of `apache-airflow-providers-git`. If it is below `0.4.1`, the system is vulnerable. You can check the installed version using the command: `pip show apache-airflow-providers-git`.
• Inspect the SSH configuration used by the Git provider. The vulnerability arises from `StrictHostKeyChecking=no` being set by default. Check for this setting in Airflow's Git provider configuration or in the SSH command-line arguments used during Git operations.
• Monitor network traffic between Airflow workers and Git servers for unusual SSH connections. Tools like `tcpdump` or `Wireshark` can be used to capture and analyze SSH traffic. For example: `tcpdump -i <interface> port 22 -w git_traffic.pcap`.
• Check for the presence of a `known_hosts` file in the Airflow environment. If the file is missing or improperly configured (e.g., pointing to `/dev/null`), the system is likely vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If your organization uses Apache Airflow with the Git provider to clone repositories over SSH, this vulnerability could have several serious impacts:

• Exposure of sensitive SSH deploy keys: An attacker could intercept and steal deploy keys, granting unauthorized access to your Git repositories.
• Injection of malicious code: An attacker could modify repository content in transit, leading to the execution of malicious code in your Airflow environment. This could result in data breaches, unauthorized actions, or further compromise of your systems.
• Compromise of workflow integrity: If malicious content is injected into your Git repositories, your Airflow DAGs (workflows) could be altered to perform unintended actions, such as exfiltrating data or triggering unauthorized processes.

The severity of this vulnerability is high (CVSS 8.1), indicating a significant risk if left unpatched.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can have implications for compliance with several common standards and regulations, depending on the nature of the data and systems involved:

• GDPR (General Data Protection Regulation): If the compromised Airflow environment processes personal data of EU citizens, the vulnerability could lead to unauthorized access or exfiltration of this data. GDPR requires organizations to implement appropriate technical measures to protect personal data, and failure to patch this vulnerability could be seen as a violation of these requirements. A breach resulting from this vulnerability could trigger mandatory reporting obligations and potential fines.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability could lead to unauthorized access or tampering with PHI. HIPAA requires safeguards to ensure the confidentiality, integrity, and availability of PHI. Exploiting this vulnerability could result in a breach of PHI, leading to non-compliance and potential penalties.
• Other standards (e.g., ISO 27001, SOC 2): Compliance frameworks like ISO 27001 and SOC 2 emphasize the importance of secure configuration and access controls. This vulnerability represents a failure to implement secure SSH practices, which could be flagged during audits as a non-conformity or control failure.

To maintain compliance, organizations should promptly apply the fix (upgrade to apache-airflow-providers-git 0.4.1 or later) and ensure proper configuration of SSH host-key verification.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-58065, follow these immediate steps:

• Upgrade the Apache Airflow Git provider to version `0.4.1` or later. Use the command: `pip install --upgrade apache-airflow-providers-git>=0.4.1`.
• Configure a `known_hosts` file to enable SSH host-key verification. Ensure the file contains the public keys of trusted Git servers. For example, manually add a server's key using: `ssh-keyscan <git-server-hostname> >> ~/.ssh/known_hosts`.
• Update the Git provider configuration to enforce host-key verification. Set `strict_host_key_checking=accept-new` or `strict_host_key_checking=yes` in the Airflow Git provider settings. This can be done by modifying the provider's configuration file or environment variables.
• Rotate any SSH deploy keys that may have been exposed due to this vulnerability. Generate new keys and update them on the Git server to prevent unauthorized access.
• Monitor Git repository content for unauthorized changes. If malicious content was injected, revert to a known-good state and investigate the source of the injection.

Useful 0 Not Useful 0