CVE-2026-94134 and CVE-2026-94135: Apache Airflow disables SSH host key verification by default

OX Security researchers discovered that Apache Airflow's SSH and SFTP providers disable SSH server host key verification by default. This allows an attacker positioned between an Airflow worker and the target server to perform a man-in-the-middle (MITM) attack, intercept or modify session data, and potentially capture credentials.

Normally, an SSH client verifies the server's public host key against a trusted key. On the first connection, the key may be stored for subsequent verification, depending on the client's configuration. Airflow uses Paramiko for synchronous SSH connections but defaults to AutoAddPolicy, which automatically accepts previously unknown host keys. The warning about disabled verification appears only in the task log after the connection has been established, not in the Airflow UI.

• CVE-2026-94134 affects SSHHook and synchronous SFTP connections. In SSHHook, no_host_key_check defaults to True. In SFTPHook, when no_host_key_check is absent from the connection's Extra settings, the provider also defaults to disabling verification by setting known_hosts="none". An attacker who intercepts the connection can impersonate the SSH server, inject command output, modify transferred files, or redirect data to attacker-controlled storage. Credential exposure depends on the authentication method and connection configuration.

• CVE-2026-94135 affects the asynchronous SFTP path. SFTPHookAsync, SFTPTrigger, and SFTPClientPool use asyncssh and pass known_hosts=None when host key verification is not explicitly enabled. Deferrable SFTP operators that use this asynchronous path are also affected. Exploitation requires the attacker to intercept or redirect traffic between the Airflow worker and the target server. Possible attack positions include ARP spoofing on a shared subnet, compromise of a network device, manipulation of routing within a cloud VPC, or BGP hijacking for internet-facing targets.

The affected packages are apache-airflow-providers-ssh and apache-airflow-providers-sftp, through version 6.0.1. Both issues were fixed in version 7.0.0 of the respective providers.

As a temporary mitigation, administrators can explicitly set no_host_key_check=false and configure a trusted host_key for affected connections. If a trusted key is not configured, the connection may fail rather than silently accepting an unknown server key.

Article: https://www.ox.security/blog/by-default-insecure-apache-airflow-disables-ssh-host-key-verification

PoC (CVE-2026-94134): https://github.com/MosesOX/POC-CVE-2026-94134