CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification
The Apache Airflow Git provider runs its git-over-SSH operations with StrictHostKeyChecking=no by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git 0.4.1 or later and configure a knownhosts file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-gitto a version that resolves this vulnerability.Fixed in 0.4.1 - Configuration
Configure the Git provider hook to use SSH host-key verification (set StrictHostKeyChecking to enable host-key checking) and provide a known_hosts file so the provider can verify the Git server host keys instead of the default StrictHostKeyChecking=no.
Apache Airflow Git provider (git-over-SSH) StrictHostKeyChecking = yes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58065?
The severity of CVE-2026-58065 is high with a CVSS score of 8.1.
How do I fix CVE-2026-58065?
To fix CVE-2026-58065, configure the Git provider hook to enable SSH host-key verification by setting StrictHostKeyChecking to yes.
What is the risk associated with CVE-2026-58065?
The risk associated with CVE-2026-58065 includes potential man-in-the-middle attacks, where an attacker can intercept and impersonate the Git server.
Which software is affected by CVE-2026-58065?
The Apache Airflow Git provider is affected by CVE-2026-58065.
When was CVE-2026-58065 published?
CVE-2026-58065 was published on July 13, 2026.