CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.
Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-sshto a version that resolves this vulnerability.Fixed in 7.0.0 - Upgrade
Upgrade
apache-airflow-providers-sftpto a version that resolves this vulnerability.Fixed in 7.0.0 - Configuration
Set no_host_key_check explicitly to false, or configure host_key, so SSH host-key verification is enabled.
Apache Airflow SSH and SFTP provider hooks no_host_key_check = false
Event History
Frequently Asked Questions
Which Airflow connections are exposed to this issue?
SSH and SFTP connections using the affected providers are exposed when they rely on the default host-key behavior. Connections with a configured host_key, or with no_host_key_check explicitly set to false, are not using the vulnerable default.
What does an attacker need to exploit this?
An attacker must be in a machine-in-the-middle position between the Airflow worker and the SSH or SFTP server. They can then impersonate the server and capture credentials or data sent by the task.
What can be done before upgrading?
Configure host_key for each SSH or SFTP connection, or explicitly set no_host_key_check to false. This enables host-key verification rather than accepting any server key.
Which upgrades address the issue?
Upgrade apache-airflow-providers-ssh to version 7.0.0 or later and apache-airflow-providers-sftp to version 7.0.0 or later. The SFTP 7.0.0 release also fixes the separately tracked deferrable SFTP issue, CVE-2026-94135.