Apache Airflow SFTP provider vulnerabilities

2 known vulnerabilities in Apache Airflow SFTP provider from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Apache Airflow SSH provider: Key Exchange without Entity Authentication

  CVE-2026-94134Oct 15, 2026Apache

  The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An

• 9.1 Critical severity

  Apache Airflow SFTP provider: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-50203Jun 17, 2026Apache

  A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow