CVE-2026-45361
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
CVE-2026-45361 is a high vulnerability (CVSS 8.1) in Apache Apache-airflow-providers-google, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in apache-airflow-providers-google 22.0.0.
- Severity
- 8.1 HighCVSS 3.1, CVE List
- Exploit chance
- 0.59%EPSS, 48th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
22.0.0apache-airflow-providers-google +1 more
Description
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflow-providers-googlePyPI | before 22.0.0 | 22.0.0 |
apache-airflow-providers-googlePyPI | before 22.0.0, plus listed versions 1.0.01.0.0b11.0.0b21.0.0rc110.0.0 Show 45 moreShow less10.0.0rc110.1.010.1.0rc110.1.0rc210.1.110.1.1rc110.10.010.10.0rc110.10.110.10.1rc110.11.010.11.0rc110.11.110.11.1rc110.12.010.12.0rc110.13.010.13.0rc110.13.0rc210.13.0rc310.13.110.13.1rc110.14.010.14.0rc110.14.0rc210.15.010.15.0rc110.16.010.16.0rc110.17.010.17.0rc110.18.010.18.0rc110.18.0rc210.19.010.19.0rc110.2.010.2.0rc110.20.010.20.0rc110.21.010.21.0rc110.21.110.21.1rc110.21.1rc2 | 22.0.0 |
What each source reports
CVE List Score used
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
CVE-2026-45361- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-322
- Updated
- 2026-11-02
EUVDEUVD-2026-31659
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
EUVD-2026-31659- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g9v5-gjwf-9rwx
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
GHSA-g9v5-gjwf-9rwx- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-322
- Updated
- 2026-11-02
NVD
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
CVE-2026-45361- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-322
- Updated
- 2026-11-02
OSV
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
CVE-2026-45361- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-322
- Updated
- 2026-11-02
OSVGHSA-g9v5-gjwf-9rwx
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
GHSA-g9v5-gjwf-9rwx- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-322
- Updated
- 2026-11-02
OSVPYSEC-2026-166
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
- Record
PYSEC-2026-166- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/apache/airflow/pull/66746
lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org
openwall.com/lists/oss-security/2026/05/24/9
nvd.nist.gov/vuln/detail/CVE-2026-45361
Left out here: 157 versions. The JSON record has them.