CVE-2026-94134

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-ssh versions prior to 7.0.0 apache-airflow-providers-sftp versions prior to 7.0.0

Description The SSH provider hook disables SSH host-key verification by default. Unless the host key is configured or no host key check is explicitly set to false, the system accepts any server key. This flaw allows a remote attacker positioned in a machine-in-the-middle (a scenario where an attacker intercepts communication between two parties) to impersonate the server and capture credentials or data sent by a task during SSH and SFTP connections.

Recommendations Upgrade apache-airflow-providers-ssh to version 7.0.0 or later. Upgrade apache-airflow-providers-sftp to version 7.0.0 or later.