CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
The Apache Airflow SFTP provider's deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.
Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-sftpto a version that resolves this vulnerability.Fixed in 7.0.0 - Configuration
Explicitly set no_host_key_check to false on the SFTP connection to enable SSH host-key verification.
Apache Airflow SFTP provider deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) no_host_key_check = false
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using apache-airflow-providers-sftp that run SFTP sensors or operators in deferrable mode are affected, because those paths use SFTPTrigger, SFTPHookAsync, or SFTPClientPool.
What must an attacker be able to do?
An attacker must be in a machine-in-the-middle position between the Airflow triggerer and the SFTP server. They can then impersonate the server and capture credentials or data exchanged over the connection.
Can the vulnerable behavior be avoided through connection configuration?
Yes. The deferrable code paths disable host-key verification unless the connection explicitly sets no_host_key_check to false.
What upgrade addresses this issue and the related synchronous-hook issue?
Upgrade apache-airflow-providers-sftp to version 7.0.0 or later. This release fixes both this defect and CVE-2026-94134; fixing one alone does not address the other.