Index
Search
Search the public record. Drafts and scheduled notes are not included.
High
news
Apache Airflow SSH and SFTP providers skip host key checks by default (CVE-2026-94134, CVE-2026-94135)
Apache Airflow's SSH and SFTP providers do not verify SSH host keys by default, so a machine-in-the-middle can impersonate the server. CVE-2026-94134 covers the SSH hook, CVE-2026-94135 the deferrable SFTP paths. Versions through 6.0.1. Fixed in 7.0.0. NVD scores 9.1 and 4.3; OX Security says 8.1. Not in CISA KEV.
Published 5h ago
MediumNo PoC
CVE-2026-94135
Apache Airflow async SFTP hook disables host key verification by default
Other
Published 3d ago