Apache Airflow Google Provider up to 21.x SSH Host-Key Verification key exchange without entity authentication

Summaryinfo

A vulnerability has been found in Apache Airflow Google Provider up to 21.x and classified as problematic. Affected by this issue is some unknown functionality of the component SSH Host-Key Verification. Performing a manipulation results in key exchange without entity authentication. This vulnerability is reported as CVE-2026-45361. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache Airflow Google Provider up to 21.x. It has been classified as problematic. This affects an unknown part of the component SSH Host-Key Verification. The manipulation with an unknown input leads to a key exchange without entity authentication vulnerability. CWE is classifying the issue as CWE-322. The product performs a key exchange with an actor without verifying the identity of that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-45361 since 05/12/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/25/2026).

Upgrading to version 22.0.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31659). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• Apache

Name

• Airflow Google Provider

Version

• 21.x

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion