CVE-2026-94134

Received Received - Intake

SSH Host Key Verification Bypass in Apache Airflow SSH Provider

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Apache Software Foundation

Description

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-94134

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Airflow SSH provider 0
Apache	Software	Foundation Apache Airflow SFTP provider 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-322	The product performs a key exchange with an actor without verifying the identity of that actor.

Attack-Flow Graph

Executive Summary

The Apache Airflow SSH provider hook disables SSH host-key verification by default. Unless explicitly configured with a host key or setting no_host_key_check to false, it accepts any server key. This allows man-in-the-middle attacks where an attacker can impersonate the SSH or SFTP server and capture credentials or data sent by tasks.

Detection Guidance

Check if your Apache Airflow SSH provider version is below 7.0.0 or SFTP provider version is below 7.0.0. Inspect Airflow configuration files for SSH/SFTP connections where host_key is not set and no_host_key_check is not explicitly false.

Impact Analysis

An attacker in a network position between the Airflow worker and the SSH/SFTP server can intercept sensitive data or credentials. This could lead to unauthorized access, data breaches, or credential theft affecting systems relying on these connections.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, fines, or legal consequences if sensitive data is exposed due to this issue.

Mitigation Strategies

Upgrade apache-airflow-providers-ssh to version 7.0.0 or later and apache-airflow-providers-sftp to version 7.0.0 or later. Ensure host_key is configured or set no_host_key_check to false in SSH/SFTP connection configurations.

Hi! I’m here to help you understand CVE-2026-94134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70