https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T17:15:35.071635+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-94134 CVE-2026-94134 — Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default 2026-10-16T17:15:35.073713+00:00

Affected: Apache Software Foundation Apache Airflow SSH provider, Apache Software Foundation Apache Airflow SFTP provider

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.

Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.