CVE-2026-94134
Apache Airflow SSH provider disables host key verification by default
The Apache Airflow SSH provider hook accepts any server key unless host_key is configured. A machine-in-the-middle can impersonate the server. NVD lists CVSS 3.1 9.1 (CISA ADP); OX Security says 8.1. Fixed in providers-ssh and providers-sftp 7.0.0. Not in CISA KEV as of check.
By ThreatWire Desk · Published 15 Oct 2026 · Updated 19 Oct 2026
- CVSS
- 9.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Class
- Other
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Apache
- Products
- Apache Airflow providers (ssh, sftp)
- Affected
- apache-airflow-providers-ssh and apache-airflow-providers-sftp through 6.0.1, per OX Security. The Apache record lists versions before 7.0.0 as affected.
- Fixed
- apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later.
- CWE
- CWE-322
- Published
- 15 Oct 2026
- Updated
- 19 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-94134 is a flaw in the Apache Airflow SSH provider. By default the SSH hook does not verify the server's host key. Apache says it accepts any key unless host_key is set or no_host_key_check is explicitly set to false.
That affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between a worker and the server can impersonate the server. They can capture credentials or data a task sends.
NVD lists CVSS 3.1 9.1 for this CVE, a score added by CISA ADP. OX Security, which found the issue, rates it 8.1 with a harder attack complexity. GitHub's advisory rates it critical. The record was awaiting analysis in NVD on 18 October 2026.
Fixed in apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP paths are a separate CVE, CVE-2026-94135.
OX Security published a proof-of-concept repository for this CVE. It describes a fake SSH server that a client with the default policy accepts. ThreatWire has not run it.
The CVE is not in the CISA KEV catalog as of 19 October 2026. No exploitation has been reported.
What to do: upgrade both providers to 7.0.0 or later. Set host key checking explicitly on existing connections.