CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Attackers can intercept SSH/SFTP connections due to disabled host-key verification, capturing credentials and data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94134?
CVE-2026-94134 is a critical vulnerability in Apache Airflow SFTP provider, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.
Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.
Weakness: CWE-322
Which versions are affected by CVE-2026-94134?
How do I fix CVE-2026-94134?
No fix has been published for CVE-2026-94134 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94134 being exploited?
There is no known exploitation of CVE-2026-94134 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-p86c-663x-5pxq.