Apache Airflow SSH and SFTP providers skip host key checks by default (CVE-2026-94134, CVE-2026-94135)

What happened

On 15 October 2026 Apache published two CVEs for Airflow's SSH and SFTP providers. OX Security, which found the issue, published its research on 16 October.

The cause is a default. The providers do not check the SSH server's host key unless you set it up. A host key check is how a client spots a fake server. Without it, any server key is accepted.

What is confirmed

• CVE-2026-94134. The SSH provider hook accepts any server key unless host_key is set or no_host_key_check is explicitly set to false. It affects SSH and SFTP connections that rely on the default.
• CVE-2026-94135. The deferrable SFTP code paths have the same default. Deployments that run SFTP sensors or operators in deferrable mode are affected. Apache treats it as a separate defect.
• Impact. An attacker in a machine-in-the-middle position between Airflow and the server can impersonate it. Apache says they can capture credentials or data a task sends.
• Versions. OX Security says both providers through 6.0.1 are affected. Apache says upgrade to 7.0.0.
• Fix. apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. Apache says the SFTP 7.0.0 release fixes both CVEs.
• Scores. NVD lists CVSS 3.1 9.1 for CVE-2026-94134 and 4.3 for CVE-2026-94135, both added by CISA ADP. OX Security rates both 8.1. GitHub rates the first critical and the second medium. The scores disagree. Attack complexity is the main difference.
• PoC. OX Security links a repository titled as a proof of concept for CVE-2026-94134. It describes a fake SSH server that a client using the default policy accepts. ThreatWire has not run it. No PoC is known for CVE-2026-94135.
• KEV. Neither CVE is in the CISA KEV catalog as of 19 October 2026.

What is not known

• Whether anyone exploits this. No source reports attacks.
• How many Airflow installs rely on the defaults. OX Security says most are likely affected, but gives no count.
• Which score best fits real risk. An attacker needs a network position between Airflow and the server.

Who should act

• Anyone running Airflow with apache-airflow-providers-ssh or apache-airflow-providers-sftp through 6.0.1.
• Teams that run SSHOperator, SFTPOperator, sensors or deferrable SFTP tasks.
• Teams whose Airflow workers reach servers across shared networks, cloud routes or the internet.

What to do now

1. Upgrade both providers to 7.0.0 or later.
2. Set host key checking explicitly on every existing SSH and SFTP connection. Give each connection the server's known host key and turn off the skip option. A connection with checking on and no key will fail. That is the safe behavior.
3. Find connections that ran unchecked. Airflow writes a warning to the task log when it connects without verifying the key. Search task logs for that warning.
4. If you suspect interception, rotate credentials and keys stored in the affected connections. Review access logs on the target servers for unexpected sessions. Check transferred files for changes.
5. Prefer private network paths between Airflow and the servers it reaches.

Sources: Apache announcements, OX Security, NVD, GitHub advisories, OSV.