CVE-2026-94135

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-sftp versions prior to 7.0.0

Description Deferrable code paths within the SFTP provider, specifically SFTPTrigger, SFTPHookAsync, and SFTPClientPool, disable SSH host-key verification by default unless the no host key check variable is explicitly set to false. This affects deployments utilizing SFTP sensors or operators in deferrable mode. A machine-in-the-middle attacker positioned between the triggerer and the SFTP server could impersonate the server to capture exchanged data or credentials.

Recommendations Upgrade to apache-airflow-providers-sftp 7.0.0 or later.