CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

As cited

Copy frozen at 2026-10-16 02:43 UTC (site build).

vulnerabilities

CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

Apache Airflow SFTP provider versions before 7.0.0 disable SSH host-key verification by default in deferrable code paths, allowing potential man-in-the-middle attacks. The vulnerability affects deployments running SFTP sensors or operators in deferrable mode unless the connection explicitly disables the `no_host_key_check` setting.

Why it matters: Teams using Apache Airflow SFTP provider in deferrable mode should upgrade to version 7.0.0 or later to prevent man-in-the-middle interception of SFTP credentials and data.

Source published

2026-10-15 23:03 UTC

First seen by Cybersecurity Tracker

2026-10-16 01:28 UTC