CVE-2026-94135

Received Received - Intake

SSH Host Key Verification Bypass in Apache Airflow SFTP Provider

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Apache Software Foundation

Description

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-94135

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Airflow SFTP provider 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-322	The product performs a key exchange with an actor without verifying the identity of that actor.

Attack-Flow Graph

Executive Summary

The Apache Airflow SFTP provider has a vulnerability in its deferrable code paths where SSH host-key verification is disabled by default. This means that unless explicitly configured otherwise, the system does not verify the identity of the SFTP server, making it vulnerable to man-in-the-middle attacks.

Detection Guidance

Check if your Apache Airflow SFTP provider is running in deferrable mode without explicit host-key verification. Inspect connection settings for SFTP operators or sensors to ensure no_host_key_check is set to false. Review logs for unexpected SSH connections or credential exchanges.

Impact Analysis

An attacker could intercept communications between the Airflow triggerer and the SFTP server, impersonate the server, and capture sensitive credentials or data being exchanged. This could lead to unauthorized access to systems or data breaches.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Upgrade apache-airflow-providers-sftp to version 7.0.0 or later. Ensure all SFTP connections explicitly set no_host_key_check to false. Verify that SSH host-key verification is enabled in deferrable mode deployments.

Hi! I’m here to help you understand CVE-2026-94135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70