{"id":"CVE-2026-94134","published":"2026-10-15T22:21:12.023","lastModified":"2026-10-16T15:20:39.130","description":"The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.\n\nUsers of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-322"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/airflow/pull/73419","tags":[]},{"url":"https://lists.apache.org/thread/ksr1lztvd3zr74f8xd1hzch1ssl0l3lj","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94135","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/airflow/pull/73419","tags":[]}],"hasPoc":true,"ai":{"summary":"Apache Airflow's SSH provider hook defaults to disabling host key verification, allowing attackers to impersonate SSH servers in man-in-the-middle attacks and capture credentials or data. This affects both SSH and SFTP connections using default configurations.","exploitability":"Exploitation requires an attacker to position themselves between the Airflow worker and target SSH/SFTP server, but is relatively straightforward once achieved since the default configuration accepts any server key without verification.","blast_radius":"The impact could be severe across all Airflow workflows that use SSH or SFTP connections with default configurations, potentially exposing sensitive credentials and data to attackers who can intercept these connections.","remediation":"Upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssh","sftp","mitm","credential-theft"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:48:51.507Z"}}