CVE-2026-94135None▾ SunlitThe Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Apache Airflow SFTP provider's deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) disable SSH host-key verification by default unless the connection explicitly sets no_host_key_check to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.
Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.
apache-airflow-providers-sftp < 7.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94134NoneApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
CVE-2026-50203Critical· 9.1Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
CVE-2026-96806NoneApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-92228NoneApache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
CVE-2026-107460NoneServer-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding
CVE-2026-92120NoneOAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.