CyberSecBulletin
CVE-2026-94134NVD status: Awaiting Analysis

Apache Airflow SSH provider: Key Exchange without Entity Authentication

Published Updated By the CyberSecBulletin desk

CVE-2026-94134 is a critical-severity key exchange without entity authentication vulnerability in Apache Airflow SSH provider from Apache, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 7.0.0 as the first without the flaw, so updating Apache Airflow SSH provider to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.6% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Apache Airflow SSH provider to 7.0.0 or a later version.
  2. Update Apache Airflow SFTP provider to 7.0.0 or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ApacheApache Airflow SSH providerbefore 7.0.07.0.0
ApacheApache Airflow SFTP providerbefore 7.0.07.0.0

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by CISA (ADP).

Official description

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Key Exchange without Entity Authentication

The product performs a key exchange with an actor without verifying the identity of that actor.

How developers prevent this class of flaw

  • Ensure that proper authentication is included in the system design.
  • Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

More Key Exchange without Entity Authentication vulnerabilities (CWE-322)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Other vulnerabilities in Apache Airflow SSH provider

All Apache Airflow SSH provider vulnerabilities

Recent Key Exchange without Entity Authentication vulnerabilities

Spotted an error? Tell us.