Patent milestone supports continued progress toward scalable production of next-generation lithium battery cells

RENO, Nev., June 18, 2026 — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in energy storage and maker of Battle Born Batteries®, today announced it has received a notice of allowance from the United States Patent and Trademark Office for its patent application titled “Powderized Solid-State Electrolyte and Electroactive Materials.”

The allowed patent application is directed toward manufacturing processes that support Dragonfly Energy’s solid-state battery development efforts. The technology further strengthens the Company’s U.S. intellectual property position in advanced battery cell manufacturing.

“This U.S. patent allowance milestone is an important step in protecting the materials and processes we believe are central to the future of solid-state battery manufacturing,” said Dr. Denis Phares, Chief Executive Officer of Dragonfly Energy. “Our team continues to advance technologies designed to simplify production, support scalability, and move us closer to the commercialization of all-solid-state battery cells.”

Dragonfly Energy’s solid-state development efforts are part of the Company’s broader strategy to advance domestic battery cell manufacturing through proprietary materials, powder-based processing, and scalable production methods. The Company believes these technologies can support the future deployment of nonflammable, all-solid-state battery cells across a range of energy storage applications.

The milestone follows multiple recent international patent allowances related to Dragonfly Energy’s dry electrode and solid-state battery development, further demonstrating the Company’s progress in building a broad intellectual property portfolio around advanced battery manufacturing.

For more information about Dragonfly Energy, visit Dragonflyenergy.com.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a comprehensive lithium battery technology company, specializing in cell manufacturing, battery pack assembly, and full system integration. Through its renowned Battle Born Batteries® brand, Dragonfly Energy has established itself as a frontrunner in the lithium battery industry, with hundreds of thousands of reliable battery packs deployed in the field through top-tier OEMs and a diverse retail customer base. At the forefront of domestic lithium battery cell production, Dragonfly Energy’s patented dry electrode manufacturing process can deliver chemistry-agnostic power solutions for a broad spectrum of applications, including energy storage systems, electric vehicles, and consumer electronics. The Company’s overarching mission is the future deployment of its proprietary, nonflammable, all-solid-state battery cells.

To learn more about Dragonfly Energy and its commitment to clean energy advancements, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the Company’s intellectual property portfolio, the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

Investor Relations

Eric Prouty

Szymon Serowiecki

AdvisIRy Partners

[email protected]

Dragonfly Energy Media Relations

Source: Dragonfly Energy Holdings Corp.

Strengthens AI and data strategy with battery simulation and European market expertise

RENO, Nev., June 23, 2026 — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in energy storage and maker of Battle Born Batteries®, today announced the appointment of Dr. Lukas Lutz to its Board of Directors.

Dr. Lutz brings a combination of deep technical expertise in battery technology and developing artificial intelligence and machine learning applications for the engineering world. Together with Luca Scherrer and Dr. Daniel Alves Dalla Corte, he is Co-Founder of Sphere Energy, a Germany-based technology company applying AI to engineering. Sphere has built an AI Operating System that enables large corporate environments to scale AI applications across their organizations. Its proprietary transformer-based models automate some of the hardest challenges in the field — from autonomously generating CAD parts from a single requirement, to optimizing complex crash scenarios, to simulating battery aging and performance from just a handful of tests.

He holds a Ph.D. in the Physical-Chemistry from the Université Paris-Sorbonne, co-chaired by the University of Oxford, a Master of Science in Physical Chemistry from ETH Zürich, and has conducted research in semiconductor materials at the University of California, Berkeley.

Dr. Lutz is actively engaged in the international battery ecosystem, including having served on several boards, such as on the Advisory Committee for The Battery Show Europe, where he helps shape industry dialogue around data-driven battery innovation, and the technology advisory board of a German Premium Power-Tooler.

“Dragonfly Energy is uniquely positioned in its ability to access and leverage extensive real-world battery data,” said Dr. Lukas Lutz. “The combination of that data, proprietary battery management systems, and deployed systems in the field creates a strong foundation for applying artificial intelligence and machine learning to improve performance, accelerate development, and better understand battery behavior over time. I look forward to supporting the team as they continue to advance this opportunity.”

“We are pleased to welcome Dr. Lutz to our Board of Directors,” said Dr. Denis Phares, Chief Executive Officer of Dragonfly Energy. “His experience at the intersection of battery science and advanced data modeling aligns well with our focus on advancing battery technology through integrated system design and manufacturing innovation. Dragonfly Energy’s ability to connect field performance data with in-house testing and cell development, including our dry electrode manufacturing platform, is a key part of our long-term strategy. Dr. Lutz’s perspective will be valuable as we continue to build on that foundation.”

The appointment reflects Dragonfly Energy’s continued focus on integrating data and advanced analytics across its technology platform. With a large installed base of Battle Born Batteries, proprietary battery management systems, and in-house research capabilities, the Company is able to study battery performance from real-world use down to the molecular level. These insights support ongoing advancements in battery design, lifecycle performance, and next-generation cell manufacturing, including its patented dry electrode and solid state technologies.

For more information about Dragonfly Energy, visit Dragonflyenergy.com.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a comprehensive lithium battery technology company, specializing in cell manufacturing, battery pack assembly, and full system integration. Through its renowned Battle Born Batteries® brand, Dragonfly Energy has established itself as a frontrunner in the lithium battery industry, with hundreds of thousands of reliable battery packs deployed in the field through top-tier OEMs and a diverse retail customer base. At the forefront of domestic lithium battery cell production, Dragonfly Energy’s patented dry electrode manufacturing process can deliver chemistry-agnostic power solutions for a broad spectrum of applications, including energy storage systems, electric vehicles, and consumer electronics. The Company’s overarching mission is the future deployment of its proprietary, nonflammable, all-solid-state battery cells.

To learn more about Dragonfly Energy and its commitment to clean energy advancements, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the Company’s new board member, the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

###

Investor Relations

Eric Prouty

Szymon Serowiecki

AdvisIRy Partners

[email protected]

Dragonfly Energy Media Relations

Source: Dragonfly Energy Holdings Corp.

Keller brings nearly four decades of experience across fleet operations, commercial vehicle sales, transportation technology and strategic account development

RENO, Nev., July 21, 2026 — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in energy storage and maker of Battle Born Batteries®, today announced that Robert Keller has joined the Company as its Director of National Fleet Sales, strengthening Dragonfly Energy’s commercial presence within the heavy-duty trucking market.

Mr. Keller brings nearly four decades of experience across fleet operations, commercial vehicle sales, telematics and fleet technology. His career includes prior leadership and sales roles with Volvo Trucks North America, Road Ready Advanced Telematics and Fleetworthy Solutions, Inc. Throughout his career, he has developed strategic relationships with some of the nation’s largest commercial fleets and helped grow transportation technology businesses.

“We believe Robert brings a valuable combination of direct fleet experience, strong industry relationships and a deep understanding of the technologies shaping commercial transportation,” said Wade Seaburg, Chief Commercial Officer of Dragonfly Energy. “His perspective will be important as we continue expanding the adoption of our battery and power system technologies across the heavy-duty trucking market.”

In his new role, Mr. Keller will focus on expanding national fleet relationships and supporting broader adoption of Dragonfly Energy’s integrated power systems. These technologies are designed to provide reliable auxiliary power while helping fleets reduce engine idling, fuel consumption and operating costs.

“Throughout my career, I have worked alongside fleets to solve operational challenges and improve efficiency,” Mr. Keller said. “Having personally relied on Battle Born Batteries in my own Airstream, I have seen firsthand the quality and reliability Dragonfly Energy delivers. I am excited to help commercial fleets adopt innovative power solutions designed to reduce operating costs, improve the driver experience and prepare customers for the future of transportation.”

For more information about Dragonfly Energy, visit Dragonflyenergy.com.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a comprehensive lithium battery technology company, specializing in cell manufacturing, battery pack assembly, and full system integration. Through its renowned Battle Born Batteries® brand, Dragonfly Energy has established itself as a frontrunner in the lithium battery industry, with hundreds of thousands of reliable battery packs deployed in the field through top-tier OEMs and a diverse retail customer base. At the forefront of domestic lithium battery cell production, Dragonfly Energy’s patented dry electrode manufacturing process can deliver chemistry-agnostic power solutions for a broad spectrum of applications, including energy storage systems, electric vehicles, and consumer electronics. The Company’s overarching mission is the future deployment of its proprietary, nonflammable, all-solid-state battery cells.

To learn more about Dragonfly Energy and its commitment to clean energy advancements, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the Company’s new Director of National Fleet Sales, the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

Investor Relations

Eric Prouty 

Szymon Serowiecki 

AdvisIRy Partners 

[email protected] 

Dragonfly Energy Media Relations

Source: Dragonfly Energy Holdings Corp.

RENO, Nev., July 30, 2026 — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in energy storage and maker of Battle Born Batteries®, today announced that the Company will release its financial and operational results for the second quarter ended June 30, 2026 after market close on Thursday, August 6, 2026. The earnings press release will be followed by a conference call on Thursday, August 6, 2026, at 4:30 PM Eastern Time.

Interested investors and other parties may access the live webcast via the link found here or through the Events and Presentations page within the Investor Relations section of Dragonfly Energy’s website at https://investors.dragonflyenergy.com/events-and-presentations/default.aspx. To join by phone and participate in the Q&A, please register in advance here; dial-in details and a unique PIN will be provided upon registration. Please log in to the webcast or dial in to the call at least 10 minutes prior to the start of the event.

An archive of the webcast will be available for a period of time shortly after the call on the Events and Presentations page on the Investor Relations section of Dragonfly Energy’s website, along with the earnings press release.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a comprehensive lithium battery technology company, specializing in cell manufacturing, battery pack assembly, and full system integration. Through its renowned Battle Born Batteries® brand, Dragonfly Energy has established itself as a frontrunner in the lithium battery industry, with hundreds of thousands of reliable battery packs deployed in the field through top-tier OEMs and a diverse retail customer base. At the forefront of domestic lithium battery cell production, Dragonfly Energy’s patented dry electrode manufacturing process can deliver chemistry-agnostic power solutions for a broad spectrum of applications, including energy storage systems, electric vehicles, and consumer electronics. The Company’s overarching mission is the future deployment of its proprietary, nonflammable, all-solid-state battery cells.

To learn more about Dragonfly Energy and its commitment to clean energy advancements, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the Company’s second quarter 2026 financial and operational results, the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

Investor Relations

Eric Prouty

Szymon Serowiecki

AdvisIRy Partners

[email protected]

Capital-efficient acquisition adds an established revenue base with expected Adjusted EBITDA accretion beginning in Q4 2026

- Acquisition expands Dragonfly Energy’s reach across marine, outdoor recreation, powersports, golf cart and other specialty battery markets

- Dakota Lithium generated approximately $12 million in net revenue in 2025 despite working-capital and inventory constraints that significantly limited product availability

- Expected to begin contributing meaningful revenue and be accretive to Adjusted EBITDA in the fourth quarter of 2026

- $4 million purchase price includes $1 million in cash, with the remaining consideration paid in Dragonfly Energy common stock valued at $2.00 per share, a premium to recent trading levels

- Concurrent lender amendments provide additional financial flexibility

RENO, Nev., July 31, 2026 — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in lithium battery technology, today announced that it has completed the acquisition of substantially all of the operating assets associated with the Dakota Lithium® brand. The acquisition expands Dragonfly Energy’s reach across marine, outdoor recreation, powersports, golf cart and other specialty battery markets and is expected to begin contributing meaningful revenue and be accretive to Adjusted EBITDA in the fourth quarter of 2026.

Dakota Lithium is a recognized lithium iron phosphate battery brand with an established presence across specialty battery markets. The acquired assets include the Dakota Lithium brand and related intellectual property, product inventory, a complementary battery portfolio, and established customer and distributor relationships.

Based on historical financial information provided to Dragonfly Energy, Dakota Lithium generated approximately $12 million in net revenue in 2025, significantly below levels achieved in prior years amid working-capital limitations and inventory constraints that materially reduced product availability.

Dragonfly Energy plans to support the Dakota Lithium brand through its existing commercial, operational, fulfillment and customer-support infrastructure. The Company believes this approach can help restore product availability, support existing customers and create a complementary revenue stream without requiring a proportional increase in fixed overhead.

Dragonfly Energy intends to operate Dakota Lithium as a distinct brand alongside Battle Born Batteries®. The multi-brand strategy is expected to broaden the Company’s overall product offering, reach additional customer segments and price points, and expand its participation across complementary battery markets while preserving the established positioning of each brand.

The total purchase price was $4.0 million, consisting of $1.0 million in cash and $3.0 million in Dragonfly Energy common stock. The equity consideration was valued at $2.00 per share, or 1,500,000 shares of common stock, representing a premium to recent trading levels, and is subject to a 12-month contractual lock-up. The transaction structure limits upfront cash requirements and preserves liquidity as the acquired operations are integrated.

In connection with the transaction, Dragonfly Energy’s existing lenders agreed to amend certain terms of the Company’s debt arrangements, including reducing the Company’s minimum cash covenant and providing for the next two quarters of interest to be paid in kind rather than in cash. These amendments are expected to preserve approximately $1 million of near-term liquidity and provide the Company with additional financial flexibility.

“We believe Dakota Lithium represents a compelling strategic and financial opportunity for Dragonfly Energy,” said Dr. Denis Phares, Chief Executive Officer of Dragonfly Energy. “The business established a meaningful multiyear revenue base across attractive specialty battery markets, but more recently faced working-capital and inventory constraints that limited product availability. By supporting the Dakota Lithium brand through infrastructure we already have in place, we believe we can restore availability, reconnect with customers and grow the business efficiently. We expect the acquisition to support our goal of achieving positive Adjusted EBITDA in the fourth quarter of 2026.

The shares of common stock described above were offered under Section 4(a)(2) of the Securities Act of 1933, as amended (the “Act”) and have not been registered under the Act, or applicable state securities laws. Accordingly, such shares may not be offered or sold in the United States except pursuant to an effective registration statement or an applicable exemption from the registration requirements of the Act and such applicable state securities laws.

The transaction was facilitated by an affiliate of Resolution Financial Advisors LLC, a specialty financial advisory firm based in Los Angeles, New York and Silicon Valley.

This press release shall not constitute an offer to sell or a solicitation of an offer to buy, nor shall there be any sale of these securities in any state or jurisdiction in which such an offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.

For more information about Dragonfly Energy, visit Dragonflyenergy.com.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a lithium battery technology company spanning battery cell manufacturing, pack assembly and full-system integration. The Company develops and delivers energy storage solutions for mobile, off-grid, industrial and specialty applications.

Dragonfly Energy is advancing domestic battery cell manufacturing through its patented dry electrode process and the development of next-generation battery technologies, including all-solid-state battery cells. Its work combines advanced research and development with software-enabled intelligence to improve the performance and capabilities of energy storage systems.

To learn more, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the anticipated benefits, timing and integration of the Dakota Lithium acquisition, the expected contribution of Dakota Lithium to the Company’s revenue and Adjusted EBITDA, the Company’s expectation of achieving positive Adjusted EBITDA in the fourth quarter of 2026, the Company’s multi-brand strategy, the anticipated effects of the lender amendments on the Company’s liquidity and financial flexibility, the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

Investor Relations

Eric Prouty 

Szymon Serowiecki 

AdvisIRy Partners 

[email protected] 

Dragonfly Energy Media Relations

Source: Dragonfly Energy Holdings Corp.

Second Quarter Net Sales In-Line With Guidance; Adjusted EBITDA Above Guidance

Cost Reduction Actions Drive $3.0 Million Sequential Improvement in Adjusted EBITDA

Announced Acquisition of Dakota Lithium Assets, Broadening Product Portfolio and Expanding Revenue Opportunity Across Key End Markets

Provides Third Quarter 2026 Guidance and Reaffirms Target of Positive Adjusted EBITDA at $70M Annual Net Sales Run Rate

Heavy-Duty Trucking Revenue Expected to More Than Double Sequentially in Q3 as Fleet Programs Expand

Second Quarter 2026 Preliminary Financial Highlights

- Net sales were $13.2 million.

- OEM net sales were $8.4 million.

- Gross Margin was 33.0%.

- Net Loss Attributable to Common Shareholders was $(5.5) million.

- Adjusted EBITDA was $(1.6) million.

RENO, Nev., Aug. 06, 2026 (GLOBE NEWSWIRE) — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in lithium battery technology, today reported its preliminary financial and operational results for the second quarter ended June 30, 2026.

“Second-quarter net sales were in line with our guidance, while Adjusted EBITDA exceeded our expectations as the cost actions implemented earlier this year began to take effect,” commented Dr. Denis Phares, Chief Executive Officer. “Adjusted EBITDA improved $3.0 million as compared to the first quarter of 2026 and $0.6 million year over year despite lower net sales, demonstrating the operating leverage inherent in our improved cost structure.”

“In the heavy-duty trucking market, the commercial ramp we have been building began to translate into meaningful revenue as deliveries under the Stevens Transport purchase order commenced during the quarter. As fleets expand deployments following initial pilot programs, we expect revenue from this market to more than double sequentially in the third quarter, with continued growth in the fourth quarter and beyond.”

“Subsequent to quarter-end, we acquired the assets of the Dakota Lithium brand, representing a compelling strategic and financial opportunity for Dragonfly,” continued Dr. Phares. “Dakota Lithium is a recognized brand with established customer and distributor relationships across marine, outdoor recreation, powersports, golf cart and other specialty battery markets. The acquisition broadens our overall product portfolio and further diversifies our revenue base beyond our core RV and trucking markets. We expect Dakota to begin contributing meaningful revenue and to be accretive to Adjusted EBITDA starting in the fourth quarter.”

“In connection with the transaction, existing lenders amended the Company’s debt arrangements, including reducing the minimum cash covenant, converting the next two quarters of interest to paid-in-kind interest, and deferring the Senior Leverage Ratio and Fixed Charge Coverage Ratio covenant requirements until September 2027. Collectively, these amendments are expected to preserve approximately $1 million of near-term liquidity and provide the Company with meaningful additional financial flexibility.”

Second Quarter 2026 Preliminary Financial and Operating Results

Net sales were $13.2 million, including $8.4 million in OEM net sales and $4.5 million in DTC net sales. OEM net sales declined year over year against an industry backdrop in which RV shipments were down 14.2% through midyear, reflecting continued macroeconomic pressure on industry production volumes. Despite that environment, the Company continued to expand model placements and power system content across its existing OEM partnerships. DTC sales declined due to macroeconomic pressures on consumer demand, as well as negative third-party online commentary regarding certain of our products, which we believe has adversely affected customer sentiment. We have initiated legal proceedings to address this commentary.

Gross profit was $4.3 million, with a gross margin of 33.0%, compared to gross profit of $4.6 million and gross margin of 28.3%. The decrease in gross profit was primarily due to lower unit volume of battery and accessory sales, with an offset from a $1.1 million benefit related to tariff refund recognized in cost of sales. Operating Expenses totaled $7.2 million, down from $7.9 million, benefiting from the Company’s cost reduction actions. The Company also continued to advance its previously announced facility consolidation during the second quarter. While the process was not fully completed by quarter-end, the Company expects to complete the principal remaining actions during the third quarter.

The Company reported a Net Loss of $(4.4) million and a Net Loss Attributable to Common Shareholders of $(5.5) million, or $(0.43) per diluted share. This compares to a Net Loss and a Net Loss Attributable to Common Shareholders of $(7.0) million, or $(5.77) per share, respectively.

Adjusted EBITDA excluding stock-based compensation, changes in the fair market value of our warrants, and other one-time expenses, was $(1.6) million, a $0.6 million improvement compared to a loss of $(2.2) million in the second quarter of 2025. Sequentially, Adjusted EBITDA improved $3.0 million from the $(4.6) million reported in the first quarter of 2026, driven by our cost reduction actions.

The second quarter financial and operating results are preliminary and are subject to finalization and adjustment in connection with the review of the financial statements for the three months ended June 30, 2026 and the preparation of the Company’s Quarterly Report on Form 10-Q for the three months ended June 30, 2026. The preliminary financial results included in this press release have been prepared by, and are the responsibility of, the Company’s management. During the course of the preparation of the Company’s financial statements and related notes as of and for the three months ended June 30, 2026, the Company may identify items that would require it to make material adjustments to the preliminary financial results presented herein. As a result, investors should exercise caution in relying on this information and should not draw any inferences from this information. This preliminary financial information should not be viewed as a substitute for full financial statements prepared in accordance with GAAP and reviewed by the Company’s independent registered public accounting firm.

Summary and Outlook

“Looking ahead to the third quarter, we expect continued growth in energy storage content and model integration across our OEM partnerships against a continued soft RV market, and trucking sales to ramp through the balance of the year. Our focus in the near term is on disciplined execution as we build on our expanding commercial foundation, integrate the Dakota Lithium brand, which we expect to begin contributing meaningful revenue in the fourth quarter, and drive operating leverage from our improved cost structure. We remain on track toward our target of Adjusted EBITDA profitability at an annualized net sales run rate of approximately $70 million,” concluded Dr. Phares.

Q3 2026 Guidance

- Net Sales of approximately $13.5 million.

- Adjusted EBITDA of approximately $(2.4) million*

* The Company cannot reconcile its expected adjusted operating EBITDA under “Q3 2026 Guidance” without unreasonable effort because certain items that impact net (loss) income and other reconciling metrics are out of the Company’s control and/or cannot be reasonably predicted at this time. Actual results may vary from the guidance and the variations may be material.

The third-quarter Adjusted EBITDA outlook reflects two temporary timing factors: continued expense associated with vacated facility space that is actively being marketed for sublease, and incremental operating costs to restore Dakota Lithium’s commercial operations ahead of its expected meaningful revenue contribution beginning in the fourth quarter.

Use of Non-GAAP Financial Measures

Adjusted EBITDA is a non-GAAP measure and should be considered only as supplemental to, and not as superior to, financial measures prepared in accordance with United States generally accepted accounting principles (“GAAP”). Please refer to the reconciliation of Adjusted EBITDA to its nearest GAAP measure in this release.

The Company provides non-GAAP financial measures including EBITDA and Adjusted EBITDA as a supplement to GAAP financial information to enhance the overall understanding of the Company’s financial performance and to assist investors in evaluating the Company’s results of operations, period over period. Adjusted non-GAAP measures exclude significant unusual items. Investors should consider these non-GAAP measures as a supplement to, and not a substitute for financial information prepared on a GAAP basis.

EBITDA is defined as earnings before interest and other income (expenses), income taxes, and depreciation and amortization. Adjusted EBITDA is calculated as EBITDA adjusted for stock-based compensation, change in fair market value of warrant liabilities, non-recurring costs associated with strategic financing, reverse stock split, litigation and loss on settlement. Adjusted EBITDA is a performance measure that the Company believes is useful to investors and analysts because it illustrates the underlying financial and business trends relating to the Company’s core, recurring results of operations and enhances comparability between periods.

Adjusted EBITDA has limitations as an analytical tool, and it should not be considered in isolation or as a substitute for analysis of net loss or other results as reported under GAAP.

RENO, Nev., Aug. 10, 2026 — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in lithium battery technology, today announced that it will participate in Canaccord Genuity’s 46th Annual Growth Conference, taking place in Boston on August 11-13, 2026.

Dragonfly Energy’s Chief Executive Officer, Dr. Denis Phares, is scheduled to present on Tuesday, August 11th at 2:30pm ET, and will host one-on-one meetings with investors throughout the day. For additional information about the conference or to schedule a one-on-one meeting, please contact your Canaccord Genuity representative.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a lithium battery technology company spanning battery cell manufacturing, pack assembly and full-system integration. The Company develops and delivers energy storage solutions for mobile, off-grid, industrial and specialty applications.

Dragonfly Energy is advancing domestic battery cell manufacturing through its patented dry electrode process and the development of next-generation battery technologies, including all-solid-state battery cells. Its work combines advanced research and development with software-enabled intelligence to improve the performance and capabilities of energy storage systems.

To learn more, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

Investor Relations

Eric Prouty

Szymon Serowiecki

AdvisIRy Partners

[email protected]

Dragonfly Energy Media Relations

Source: Dragonfly Energy Holdings Corp.

First battery pack manufacturer to embed Sphere Energy’s AI-powered state-of-health technology into its core BMS architecture

- Sphere Energy’s proprietary battery AI models will be integrated into Dragonfly Energy’s next-generation battery management system architecture.

- The integration is designed to improve state-of-charge and state-of-health accuracy while expanding Dragonfly IntelLigence® into AI-enhanced battery management.

- The partnership will leverage Dragonfly Energy’s hundreds of thousands of deployed battery packs, established OEM relationships and vertically integrated engineering capabilities to accelerate data-driven product development.

RENO, Nev., Aug. 17, 2026 (GLOBE NEWSWIRE) — Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) (“Dragonfly Energy” or the “Company”), an industry leader in energy storage, today announced a strategic partnership with Sphere Energy to develop and integrate next-generation AI capabilities into its future battery technologies and integrated power systems.

With hundreds of thousands of battery packs deployed across a broad range of applications, Dragonfly Energy has built a substantial base of real-world operating data spanning years of field performance. The partnership will combine that data with Sphere Energy’s battery-specific AI technology, based on its AI platform VETTA®, advancing the Company’s Dragonfly IntelLigence® communications technology beyond battery connectivity and system visibility and creating an AI-driven intelligence layer across future products and systems.

Sphere Energy’s proprietary battery AI models will be integrated into Dragonfly Energy’s next-generation battery management system architecture, making Dragonfly Energy the first battery pack manufacturer to place Sphere Energy’s AI-powered state-of-health technology at its core. The integration is designed to improve the accuracy of state-of-charge and state-of-health data while creating a more flexible development platform that can help Dragonfly Energy bring new products and solutions to market faster in response to specific customer needs.

“Our established product lines, long-standing customer relationships and years of field performance have created a powerful data advantage,” said Dr. Denis Phares, chief executive officer of Dragonfly Energy. “By combining that data advantage with Sphere Energy’s battery-specific AI models, we expect to evolve Dragonfly IntelLigence into a platform capable of delivering more precise, actionable insights across the applications we serve.”

“Dragonfly Energy’s vertically integrated capabilities, substantial deployed base and established relationships with leading OEM customers provide a unique foundation for applying battery-specific artificial intelligence at scale,” said Luca Scherrer, co-founder and managing director of Sphere Energy. “That combination gives us the opportunity to apply our technology across a broad range of real-world applications and operating conditions, turning battery data into better intelligence, stronger product performance and greater value for customers.”

For fleet operators, OEMs and other commercial customers, more accurate battery intelligence is intended to provide greater visibility into battery condition and lifecycle performance, supporting better asset management and operating decisions. The AI-enabled architecture is also designed to create a faster feedback loop between field performance and product development, helping Dragonfly Energy refine existing products and accelerate future solutions.

Together, we believe these capabilities can turn Dragonfly Energy’s growing base of field data into a lasting advantage across product performance, development and customer value.

Dr. Lukas Lutz, a director of Dragonfly Energy is also a co-founder of Sphere Energy.

For more information about Dragonfly Energy, visit Dragonflyenergy.com.

About Dragonfly Energy

Dragonfly Energy Holdings Corp. (Nasdaq: DFLI) is a comprehensive lithium battery technology company, specializing in cell manufacturing, battery pack assembly, and full system integration. Through its renowned Battle Born Batteries® brand, Dragonfly Energy has established itself as a frontrunner in the lithium battery industry, with hundreds of thousands of reliable battery packs deployed in the field through top-tier OEMs and a diverse retail customer base. At the forefront of domestic lithium battery cell production, Dragonfly Energy’s patented dry electrode manufacturing process can deliver chemistry-agnostic power solutions for a broad spectrum of applications, including energy storage systems, electric vehicles, and consumer electronics. The Company’s overarching mission is the future deployment of its proprietary, nonflammable, all-solid-state battery cells.

To learn more about Dragonfly Energy and its commitment to clean energy advancements, visit investors.dragonflyenergy.com.

Forward-Looking Statements

This press release contains forward-looking statements within the meaning of the United States Private Securities Litigation Reform Act of 1995. Forward-looking statements include all statements that are not historical statements of fact and statements regarding the Company’s intent, belief, or expectations, including, but not limited to, statements regarding the Company’s strategic partnership with Sphere Energy, the expected benefits of the partnership, the integration of AI technology into the Company’s products, the Company’s future results of operations and financial position, planned products and services, business strategy and plans, market size and growth opportunities, competitive position and technological and market trends. Some of these forward-looking statements can be identified by the use of forward-looking words, including “may,” “should,” “expect,” “intend,” “will,” “estimate,” “anticipate,” “believe,” “predict,” “plan,” “targets,” “projects,” “could,” “would,” “continue,” “forecast” or the negatives of these terms or variations of them or similar expressions.

These forward-looking statements are subject to risks, uncertainties, and other factors (some of which are beyond the Company’s control) which could cause actual results to differ materially from those expressed or implied by such forward-looking statements. Such factors include those set forth in the sections entitled “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” in the Company’s Annual Report on Form 10-K for the year ended December 31, 2025, and in the Company’s subsequent filings with the SEC available at www.sec.gov. If any of these risks materialize or any of the Company’s assumptions prove incorrect, actual results could differ materially from the results implied by these forward-looking statements. There may be additional risks that the Company presently does not know or that it currently believes are immaterial that could also cause actual results to differ from those contained in the forward-looking statements. All forward-looking statements contained in this press release speak only as of the date they were made. Except to the extent required by law, the Company undertakes no obligation to update such statements to reflect events that occur or circumstances that exist after the date on which they were made.

Investor Relations

Eric Prouty

Szymon Serowiecki

AdvisIRy Partners

[email protected]

Dragonfly Energy Media Relations

Source: Dragonfly Energy Holdings Corp.

Shai-Hulud is back for another round, this time hijacking the Tensorlake package, 12k weekly downloads

Breaking News: Shai-Hulud malware affecting “tensorlake” package version 0.5.144,

Overview

A malicious version of tensorlake (version 0.5.144) was published to npm with Shai-Hulud malware.

The malware also contains an Ethereum contract address, which is tied to a wallet containing 12.44$ worth of crypto currency.

Threat actors used new public keys that differ from other attacks. This may indicate an independent threat actor or a new group using the Shai-Hulud name and malicious code.

Who is affected

- Anyone who installed or ran tensorlake@0.5.144

Recommended Actions

- Do not revoke the stolen GitHub token before isolating the machine. Disconnect the host from the network and kill the gh-token-monitor persistence first (see IOCs). Otherwise, revocation triggers rm -rf ~/ (Windows: Remove-Item $env:USERPROFILE -Recurse -Force). Then rotate your keys.

- Treat every machine that installed it as fully compromised. Rotate all GitHub, npm, cloud, Vault, SSH and CI secrets reachable from it.

- Hunt for the IOCs below across GitHub (branches, workflow files, commits) and endpoints (persistence, network).

Threat Analysis

Inside the code we detected this Ethereum contract address – 0xb614155Fd88114d40549b259457Bcf921Df091B9 which maps to this wallet – 0x779f83aE56309682beDb04816c19d358c4B21040

When examining the wallet, we can see that the account currently holds 12.44$, and was created 16 days ago.

Additionally, we can see in GitHub that 5 repositories have been uploaded with stolen credentials following this recent attack.

Technical Analysis

The malware contains heavy obfuscation, with multiple decode functions and hash functions to extract its own strings to memory when running.

Public encryption keys are newly seen, and are not connected to any of the Shai-Hulud variants we’ve seen in the past.

- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsx7qQlP6BjB14dud92Hk

- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAmSsAhtZtB2S7XBxe5Ofr

The malware’s revoke kill-switch string is the same one that was used in the TanStack attack back in May – IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner:

The malware contains infostealer logic, browser data stealing logic, crypto draining, cloud configuration stealing, environment variable stealing and many more.

Affected Packages

Conclusion

Shai-Hulud is yet again attacking AI and agentic frameworks, and in an ironic turn of events, a Sandbox for AI, the type of package that’s trying to prevent attacks and malwares like Shai-Hulud spreading in the wild.

Shai-Hulud variants keep breaking the assumption that we’ve learned our lesson and that our package managers and registries will be safe next week. Apparently, they won’t be.

The Shai-Hulud name, hardcoded in the malware’s source code, has outlived its TeamPCP origins. Group members were arrested in August. The name now works as a brand that copycats reuse.

Now, every Shai-Hulud reference becomes more of a statement, an almost poetic one, an ode to a group of threat actors that took over packages with billions of downloads all around the world.

IOCs

Domains / network

- iseekaigogo.com

- Ethereum contract 0xb614155Fd88114d40549b259457Bcf921Df091B9

Strings / markers

- WORMTAG = “tensrlake”

- WORM_PROFILE

- IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner

- thebeautifulmarchoftime

- Shai-Hulud: Here We Go Again

- Add Copilot workflow, chore: update dependencies

Files

- setup.mjs, .claude/setup.mjs, .vscode/setup.mjs, .claude/settings.json, .vscode/tasks.json

- Math_Symbol.js, math_init.js, opensearch_init.js, ai_init.js

- ~/.local/bin/gh-token-monitor.sh, ~/.config/gh-token-monitor/

- ~/.config/systemd/user/gh-token-monitor.service

- ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

- Windows scheduled task gh-token-monitor; %LOCALAPPDATA%\gh-token-monitor

How OX Can Help

The above package and future variants of this malicious campaign are included in the OX security malware database.

OX customers using VibeSec trying to install one of the malicious packages will be blocked by the platform and an alternative safe package will be suggested to them.

OX customers pushing code with the malicious package as dependency will also be blocked by the OX platform pipeline scan.

Vulnerability Details

CVE-2026-94134 – SSH hook default, both providers

CVE-2026-94135 – Async SFTP path

Severity: High – CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

CWE: CWE-322 (Key Exchange without Entity Authentication)

Affected packages: apache-airflow-providers-ssh and apache-airflow-providers-sftp – both through version 6.0.1

Fixed in: apache-airflow-providers-ssh 7.0.0 (CVE-2026-94134), apache-airflow-providers-sftp 7.0.0 (CVE-2026-94135)

Overview

OX Security Research discovered that Apache Airflow disables SSH host key verification by default in its SSH and SFTP providers, leaving connections vulnerable to man-in-the-middle (MITM) attacks.

The issue affects both synchronous SSH/SFTP connections and Airflow’s asynchronous SFTP path and has been assigned two High-severity CVEs: CVE-2026-94134 and CVE-2026-94135.

With Airflow’s default configuration, an attacker positioned between an Airflow worker and the target server can present their own key and have the connection accepted without error. The attacker can then intercept the session, capture credentials, inject command output, modify transferred files, or redirect data to attacker-controlled storage.

The problem is the default. Users do not have to disable host key verification to become vulnerable. Unless they explicitly configure Airflow otherwise, verification is already disabled.

What Is Apache Airflow

Apache Airflow is the standard open-source workflow orchestration platform. Data engineering teams use it to schedule and run pipelines that move data between databases, cloud storage, APIs, and remote servers. That is often hundreds of jobs per day.

The SSH and SFTP providers sit at the center of how Airflow reaches remote systems: SSHOperator runs shell commands on production servers, while SFTPOperator transfers files in ETL pipelines. Compromising one of these connections is not limited to what Airflow itself can do; it gives an attacker a position inside every data flow that connection participates in.

The Vulnerability

SSH server authentication works by storing a server’s public key the first time you connect, then comparing it on every future connection. If the keys differ, the connection is rejected. That’s how MITM attacks are caught. Without this check, an attacker who intercepts the TCP connection can present their own key, decrypt everything, and forward it transparently.

Paramiko (Python’s SSH library, used by Airflow) provides three host-key policies: RejectPolicy (secure, matches OpenSSH defaults), WarningPolicy (insecure but leaves a trace), and AutoAddPolicy (accepts any key silently). Airflow defaults to AutoAddPolicy.

SSH: Host Key Verification Disabled by Default

apache-airflow-providers-ssh – SSHHook.__init__ hardcodes no_host_key_check = True before reading any connection config. In get_conn(), this triggers AutoAddPolicy and writes a warning to the task log after the connection is already open:

The # nosec B507 comment suppresses Bandit’s MITM warning without fixing the behavior.

apache-airflow-providers-sftp – SFTPHook resolves no_host_key_check from the connection Extra field.

When the field is absent (the default for any new SFTP connection), the expression True if nhkc_raw is None evaluates to True, setting known_hosts = “none”, which disables all verification:

The only signal in both cases is a log warning written after the insecure connection is established, invisible to anyone not actively reading task logs.

CVE-2026-94135 – Async SFTP Path (apache-airflow-providers-sftp): SFTPHookAsync, SFTPTrigger, and SFTPClientPool use asyncssh rather than paramiko, but share the same insecure default.

When no_host_key_check is not explicitly set, these classes pass known_hosts=None to asyncssh, which disables all host key verification on the async code path.

Deferrable SFTP operators that trigger async execution are affected independently of the sync hook issue covered by CVE-2026-94134.

Attack Flow

- An Airflow pipeline task triggers an SSH or SFTP connection with default configuration.

- An attacker positioned on the network path between the Airflow worker and the target server intercepts the TCP connection. Realistic positions include ARP spoofing on a shared subnet, a compromised network device, cloud VPC routing manipulation, or BGP hijacking for internet-facing targets.

- The attacker presents their own RSA key pair instead of the legitimate server’s key.

- SSHHook calls paramiko.AutoAddPolicy() – or SFTPHook sets known_hosts=”none” – and the connection succeeds without error. No alert appears in the Airflow UI.

- The attacker now controls both sides of the session and can read credentials, inject command output, modify transferred files, or redirect data to attacker-controlled storage. Captured credentials (passwords or private keys stored in Airflow connections) can be used directly against the target server, independent of Airflow.

Proof of Concept

The PoC starts a fake SSH server with a freshly generated RSA key and connects using AutoAddPolicy – the exact policy SSHHook applies by default. The connection succeeds with no error.

Requirements: pip install paramiko

See the POC in this GitHub repository.

Expected output:

The SFTP-specific condition that disables verification requires no dependencies:

Impact

SSH and SFTP connections in Airflow typically carry service account credentials with shell access to production servers. A MITM attacker who intercepts one session captures those credentials and can use them directly – independent of Airflow – to access the target server.

For SFTP pipelines feeding databases or data warehouses, an attacker can inject modified file content into a transfer. The tainted data propagates downstream before any anomaly is detected, if it ever is.

The severity is compounded by how invisible the default behavior is. The Airflow connection form gives no indication that host key checking is disabled. The only signal is a log warning written after the insecure connection is already open, in a task log that most operators never read. Organizations running Airflow at scale with dozens or hundreds of SSH and SFTP connections are almost certainly running all of them with verification disabled.

Remediation

Upgrade to the fixed versions:

pip install “apache-airflow-providers-ssh>=7.0.0”

pip install “apache-airflow-providers-sftp>=7.0.0”

Interim mitigation – Explicitly opt into secure behavior on every existing SSH and SFTP connection. In the Airflow UI, edit each connection’s Extra field:

Get the correct host_key value:

Setting no_host_key_check=false without providing host_key will cause connections to fail. This is the correct secure behavior.

Detect affected connections – Search task logs for the warning string that marks every connection running with verification disabled:

Post-compromise – If interception is suspected: rotate all credentials in affected connections, audit target server access logs for unexpected sessions, and review SFTP-transferred files for unexpected modifications.

References

- Fix PR: apache/airflow#73419 – Verify SSH host keys by default

- apache-airflow-providers-ssh on PyPI

- apache-airflow-providers-sftp on PyPI

- Apache Airflow Security Policy

- CWE-322: Key Exchange without Entity Authentication

- paramiko AutoAddPolicy documentation

- CVE-2026-94134, CVE-2026-94135 – reserved, publishes with the advisory