Apache Airflow SSH Provider/Airflow SFTP Provider up to 6.x SSH Hook/SFTP Hook host_key/no_host_key_check certificate validation

Summaryinfo

A vulnerability classified as problematic was found in Apache Airflow SSH Provider and Airflow SFTP Provider up to 6.x. This affects an unknown part of the component SSH Hook/SFTP Hook. Executing a manipulation of the argument host_key/no_host_key_check can lead to certificate validation. The identification of this vulnerability is CVE-2026-94134. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Apache Airflow SSH Provider and Airflow SFTP Provider up to 6.x. This vulnerability affects an unknown function of the component SSH Hook/SFTP Hook. The manipulation of the argument host_key/no_host_key_check with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect integrity. CVE summarizes:

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

The advisory is available at github.com. This vulnerability was named CVE-2026-94134 since 09/20/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/16/2026). This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

Upgrading to version 7.0.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Business Process Management Software

Vendor

• Apache

Name

• Airflow SFTP Provider
• Airflow SSH Provider

Version

• 6.x

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion