Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-94134— Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

Quick assessment

Affected
Apache Software Foundation Apache Airflow SSH provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Airflow 的 SSH Provider Hook 默认禁用了 SSH 主机密钥验证：除非明确配置了 或将 显式设置为 false，否则它将接受任何服务器密钥。此问题会影响依赖默认设置的 SSH 和 SFTP 连接。处于 Worker 与 SSH/SFTP 服务器之间中间人（MitM）位置的攻击者可以冒充服务器，并捕获任务发送的凭证或数据。 建议使用 和 的用户升级到 及更高版本，以及 及更高版本。可延迟执行（deferrable）的 SFTP 代码路径存在相同的默认行为问题，已通过 CVE-20

AI Predicted 6.5 Difficulty: Moderate EPSS 0.18% · P7

Affected Version Matrix 2

VendorProduct Version RangeStatus
Apache Software Foundation Apache Airflow SFTP provider < 7.0.0 affected
Apache Software Foundation Apache Airflow SSH provider < 7.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94134

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未进行实体认证的密钥交换
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Airflow SSH provider 0 ~ 7.0.0 -
Apache Software Foundation Apache Airflow SFTP provider 0 ~ 7.0.0 -

II. Public POCs for CVE-2026-94134

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94134

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-94134 (1)

Vendor Advisories for CVE-2026-94134 (1)

Mailing List Discussions for CVE-2026-94134 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-15 · 4 CVEs total

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the se
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-322

V. Comments for CVE-2026-94134

No comments yet

Leave a comment