SSH and SFTP connections using affected provider versions are exposed when they rely on the default host-key behavior. Connections are not affected by that default if a host_key is configured or no_host_key_check is explicitly set to false.
An attacker must be in a machine-in-the-middle position between the Airflow worker and the target SSH or SFTP server. They can then impersonate the server and capture credentials or data sent by a task.
Configure host_key for affected SSH and SFTP connections, or explicitly set no_host_key_check to false. This prevents reliance on the insecure default behavior.
They had the same default behavior but are tracked separately as CVE-2026-94135. Upgrading apache-airflow-providers-sftp to 7.0.0 or later fixes both issues.