Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-94135— Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

Quick assessment

Affected
Apache Software Foundation Apache Airflow SFTP provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Airflow SFTP 提供程序的可延期代码路径（ 、 、 ）默认禁用了 SSH 主机密钥验证，除非连接中显式将 设置为 false。在可延期模式下运行 SFTP 传感器或算子的部署会受到此漏洞的影响。位于触发器与 SFTP 服务器之间的中间人攻击者可以冒充服务器，并捕获交换的凭据或数据。 建议 用户升级至版本 7.0.0 或更高版本。此漏洞与 CVE-2026-94134（同步 SSH 钩子的默认设置问题，同样影响 SFTP 钩子）属于不同缺陷；即使已修复其中一个缺陷，仍需应用此新版本以修复另一个

AI Predicted 6.5 Difficulty: Moderate EPSS 0.18% · P7

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Airflow SFTP provider < 7.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94135

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未进行实体认证的密钥交换
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Airflow SFTP provider 0 ~ 7.0.0 -

II. Public POCs for CVE-2026-94135

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94135

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-94135 (1)

Mailing List Discussions for CVE-2026-94135 (1)

Other References for CVE-2026-94135 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-15 · 4 CVEs total

CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the se
CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key veri
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role

IV. Related Vulnerabilities

Same product: Apache Airflow SFTP provider
Same vendor: Apache Software Foundation
Same weakness: CWE-322

V. Comments for CVE-2026-94135

No comments yet

Leave a comment