{"id":"CVE-2026-58065","title":"The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification","summary":"The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-322"],"vendor":"apache","product":"apache-airflow-providers-git","affected":["apache-airflow-providers-git < 0.4.1"],"patched":["apache-airflow-providers-git 0.4.1"],"published":"2026-07-13","updated":"2026-09-16","sourceUpdated":"2026-09-16T16:17:13.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58065","references":[{"url":"https://github.com/apache/airflow/pull/69103","label":"security@apache.org"},{"url":"https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/13/3","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00736,"epssPercentile":0.52559,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-14T13:38:55.410398Z"},"ingestedAt":"2026-09-16T15:58:38.780Z","slug":"CVE-2026-58065","body":"## Overview\n\nThe Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.\n\n## Affected\n\n- `apache-airflow-providers-git < 0.4.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `apache-airflow-providers-git 0.4.1`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}