Global – October 27, 2026 -- Apache Airflow's SSH and SFTP providers ship with host key verification disabled by default. Two High-severity vulnerabilities, CVE-2026-94134 and CVE-2026-94135, both rated CVSS 8.1, leave connections open to man-in-the-middle attacks, according to OX Security Research.
Both apache-airflow-providers-ssh and apache-airflow-providers-sftp are affected through version 6.0.1. Version 7.0.0 of each package fixes the flaw. The weakness is classified as CWE-322, key exchange without entity authentication.
Default configuration accepts any server key silently
Users do not have to disable verification to be exposed. Unless they configure Airflow otherwise, an attacker positioned between a worker and the target server can present their own key and the connection is accepted without error. The attacker can then intercept the session, capture credentials, inject command output, modify transferred files or redirect data to attacker-controlled storage.
In the SSH provider, SSHHook.__init__ hardcodes no_host_key_check to True before reading any connection config. This triggers Paramiko's AutoAddPolicy. The only signal is a warning written to the task log after the connection is already open.
SFTP hook disables verification whenever the Extra field is empty
SFTPHook resolves no_host_key_check from the connection Extra field. For any new SFTP connection, where the field is absent, the value evaluates to True and known_hosts is set to "none".
CVE-2026-94135 covers the asynchronous path. SFTPHookAsync, SFTPTrigger and SFTPClientPool use asyncssh and pass known_hosts=None when no_host_key_check is not explicitly set. Deferrable SFTP operators are affected independently of the synchronous issue.
Attack paths include ARP spoofing, VPC routing manipulation and BGP hijacking
OX Security lists the realistic attacker positions as ARP spoofing on a shared subnet, a compromised network device, cloud VPC routing manipulation, or BGP hijacking for internet-facing targets. No alert appears in the Airflow UI when the connection succeeds.
Airflow SSH and SFTP connections typically carry service account credentials with shell access to production servers. An attacker who captures them can use them directly against the target, independent of Airflow. SSHOperator runs shell commands on production servers and SFTPOperator moves files in ETL pipelines, so one compromised connection gives an attacker a position inside every data flow it serves.
For SFTP pipelines feeding databases or data warehouses, modified file content can propagate downstream before any anomaly is detected. OX Security says organizations running dozens or hundreds of SSH and SFTP connections are almost certainly running all of them with verification disabled.
Upgrade to 7.0.0 or set host keys on every connection
The fix, tracked in pull request apache/airflow#73419, verifies SSH host keys by default. Operators can upgrade both providers to version 7.0.0 or later.
As an interim measure, operators must set no_host_key_check=false and supply a host_key in the Extra field of each existing connection. Setting the flag without a host_key makes connections fail, which OX Security describes as the correct secure behavior. Teams can find affected connections by searching task logs for the warning string that marks each connection running without verification.
If interception is suspected, OX Security advises rotating all credentials in affected connections, auditing target server access logs for unexpected sessions, and reviewing SFTP-transferred files for modifications.