{"id":"CVE-2026-45361","aliases":["EUVD-2026-31659","GHSA-g9v5-gjwf-9rwx","PYSEC-2026-166"],"status":"published","title":"Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0059,"percentile":0.48546,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-322"],"published":"2026-05-25T09:34:01Z","modified":"2026-10-28T02:56:59Z","fixes":[{"ecosystem":"PyPI","package":"apache-airflow-providers-google","fixed_in":["22.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-airflow-providers-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.0"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0rc1","10.0.0","10.0.0rc1","10.1.0","10.1.0rc1","10.1.0rc2","10.1.1","10.1.1rc1","10.10.0","10.10.0rc1","10.10.1","10.10.1rc1","10.11.0","10.11.0rc1","10.11.1","10.11.1rc1","10.12.0","10.12.0rc1","10.13.0","10.13.0rc1","10.13.0rc2","10.13.0rc3","10.13.1","10.13.1rc1","10.14.0","10.14.0rc1","10.14.0rc2","10.15.0","10.15.0rc1","10.16.0","10.16.0rc1","10.17.0","10.17.0rc1","10.18.0","10.18.0rc1","10.18.0rc2","10.19.0","10.19.0rc1","10.2.0","10.2.0rc1","10.20.0","10.20.0rc1","10.21.0","10.21.0rc1","10.21.1","10.21.1rc1","10.21.1rc2","10.22.0","10.22.0rc1","10.23.0","10.23.0rc1","10.24.0","10.24.0rc1","10.25.0","10.25.0rc1","10.26.0","10.26.0rc1","10.3.0","10.3.0rc1","10.3.0rc2","10.4.0","10.4.0rc1","10.5.0","10.5.0rc1","10.6.0","10.6.0rc1","10.6.0rc2","10.6.0rc3","10.7.0","10.7.0rc1","10.8.0","10.8.0rc1","10.9.0","10.9.0rc1","11.0.0","11.0.0rc1","12.0.0","12.0.0rc1","12.0.0rc2","13.0.0","14.0.0","14.0.0rc1","14.1.0","14.1.0rc1","15.0.0","15.0.0rc1","15.0.1","15.0.1rc1","15.1.0","15.1.0rc1","16.0.0","16.0.0rc1","16.1.0","16.1.0rc1","17.0.0","17.0.0rc1","17.1.0","17.1.0rc1","17.2.0","17.2.0rc1","18.0.0","18.0.0rc1","18.1.0","18.1.0rc1","19.0.0","19.0.0rc1","19.1.0","19.1.0rc1","19.1.0rc2","19.2.0","19.2.0rc1","19.3.0","19.3.0rc1","19.4.0","19.4.0rc1","19.4.0rc2","19.5.0","19.5.0rc1","2.0.0","2.0.0rc1","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","20.0.0","20.0.0rc1","20.0.0rc2","21.0.0","21.0.0rc1","21.0.0rc2","21.1.0","21.1.0rc1","21.2.0","21.2.0rc1","21.3.0","21.3.0rc1","22.0.0rc1","3.0.0","3.0.0rc1","4.0.0","4.0.0rc1","4.0.0rc2","4.1.0rc1","5.0.0","5.0.0rc2","5.1.0","5.1.0rc1","6.0.0","6.0.0rc1","6.1.0","6.1.0rc1","6.2.0","6.2.0rc1","6.3.0","6.3.0rc1","6.4.0","6.4.0rc1","6.4.0rc2","6.4.0rc3","6.5.0","6.5.0rc1","6.6.0","6.6.0rc1","6.7.0","6.7.0rc1","6.8.0","6.8.0rc1","7.0.0","7.0.0rc1","8.0.0","8.0.0rc1","8.0.0rc2","8.1.0","8.1.0rc1","8.10.0","8.10.0rc1","8.11.0","8.11.0rc1","8.12.0","8.12.0rc1","8.2.0","8.2.0rc1","8.3.0","8.3.0rc1","8.3.0rc2","8.3.0rc3","8.4.0","8.4.0rc1","8.4.0rc2","8.5.0","8.5.0rc1","8.6.0","8.6.0rc2","8.6.0rc3","8.7.0","8.7.0rc1","8.7.0rc2","8.8.0","8.8.0rc1","8.9.0","8.9.0rc1","9.0.0","9.0.0rc1","9.0.0rc2"]},{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.0"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0rc1","10.0.0","10.0.0rc1","10.1.0","10.1.0rc1","10.1.0rc2","10.1.1","10.1.1rc1","10.10.0","10.10.0rc1","10.10.1","10.10.1rc1","10.11.0","10.11.0rc1","10.11.1","10.11.1rc1","10.12.0","10.12.0rc1","10.13.0","10.13.0rc1","10.13.0rc2","10.13.0rc3","10.13.1","10.13.1rc1","10.14.0","10.14.0rc1","10.14.0rc2","10.15.0","10.15.0rc1","10.16.0","10.16.0rc1","10.17.0","10.17.0rc1","10.18.0","10.18.0rc1","10.18.0rc2","10.19.0","10.19.0rc1","10.2.0","10.2.0rc1","10.20.0","10.20.0rc1","10.21.0","10.21.0rc1","10.21.1","10.21.1rc1","10.21.1rc2","10.22.0","10.22.0rc1","10.23.0","10.23.0rc1","10.24.0","10.24.0rc1","10.25.0","10.25.0rc1","10.26.0","10.26.0rc1","10.3.0","10.3.0rc1","10.3.0rc2","10.4.0","10.4.0rc1","10.5.0","10.5.0rc1","10.6.0","10.6.0rc1","10.6.0rc2","10.6.0rc3","10.7.0","10.7.0rc1","10.8.0","10.8.0rc1","10.9.0","10.9.0rc1","11.0.0","11.0.0rc1","12.0.0","12.0.0rc1","12.0.0rc2","13.0.0","14.0.0","14.0.0rc1","14.1.0","14.1.0rc1","15.0.0","15.0.0rc1","15.0.1","15.0.1rc1","15.1.0","15.1.0rc1","16.0.0","16.0.0rc1","16.1.0","16.1.0rc1","17.0.0","17.0.0rc1","17.1.0","17.1.0rc1","17.2.0","17.2.0rc1","18.0.0","18.0.0rc1","18.1.0","18.1.0rc1","19.0.0","19.0.0rc1","19.1.0","19.1.0rc1","19.1.0rc2","19.2.0","19.2.0rc1","19.3.0","19.3.0rc1","19.4.0","19.4.0rc1","19.4.0rc2","19.5.0","19.5.0rc1","2.0.0","2.0.0rc1","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","20.0.0","20.0.0rc1","20.0.0rc2","21.0.0","21.0.0rc1","21.0.0rc2","21.1.0","21.1.0rc1","21.2.0","21.2.0rc1","21.3.0","21.3.0rc1","22.0.0rc1","3.0.0","3.0.0rc1","4.0.0","4.0.0rc1","4.0.0rc2","4.1.0rc1","5.0.0","5.0.0rc2","5.1.0","5.1.0rc1","6.0.0","6.0.0rc1","6.1.0","6.1.0rc1","6.2.0","6.2.0rc1","6.3.0","6.3.0rc1","6.4.0","6.4.0rc1","6.4.0rc2","6.4.0rc3","6.5.0","6.5.0rc1","6.6.0","6.6.0rc1","6.7.0","6.7.0rc1","6.8.0","6.8.0rc1","7.0.0","7.0.0rc1","8.0.0","8.0.0rc1","8.0.0rc2","8.1.0","8.1.0rc1","8.10.0","8.10.0rc1","8.11.0","8.11.0rc1","8.12.0","8.12.0rc1","8.2.0","8.2.0rc1","8.3.0","8.3.0rc1","8.3.0rc2","8.3.0rc3","8.4.0","8.4.0rc1","8.4.0rc2","8.5.0","8.5.0rc1","8.6.0","8.6.0rc2","8.6.0rc3","8.7.0","8.7.0rc1","8.7.0rc2","8.8.0","8.8.0rc1","8.9.0","8.9.0rc1","9.0.0","9.0.0rc1","9.0.0rc2"]}],"products":[{"vendor":"apache","product":"apache-airflow-providers-google"},{"vendor":"apache software foundation","product":"apache airflow google provider"}],"references":[{"url":"https://github.com/apache/airflow/pull/66746","tags":["patch","Issue Tracking","Patch","fix","web"]},{"url":"https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2?users@airflow.apache.org","tags":["vendor-advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/24/9","tags":["Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45361","tags":["advisory"]},{"url":"https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2","tags":["web","advisory"]},{"url":"https://github.com/apache/airflow/commit/120dbed3462cedcb980aac022c587ba434249eb1","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-google/PYSEC-2026-166.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g9v5-gjwf-9rwx","tags":["advisory"]},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45361.json","tags":["advisory"]},{"url":"https://github.com/apache/airflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-45361","title":"Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-25T09:34:01.126Z","modified":"2026-06-01T15:48:53.991Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-31659","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-25T09:34:01Z","modified":"2026-06-01T15:48:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:58.316953Z"}],"ghsa":[{"id":"GHSA-g9v5-gjwf-9rwx","title":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-26T13:30:40Z","modified":"2026-06-30T16:53:08Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:40:35.701766Z"}],"nvd":[{"id":"CVE-2026-45361","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-25T10:16:15.087Z","modified":"2026-07-21T19:10:00.107Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-45361","title":"Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-25T09:34:01.126Z","modified":"2026-10-28T02:56:59.917854255Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"GHSA-g9v5-gjwf-9rwx","title":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-26T13:30:40Z","modified":"2026-06-30T17:11:25.019772022Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"PYSEC-2026-166","description":"Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.","status":"published","published":"2026-05-25T10:16:15.087Z","modified":"2026-07-13T16:45:04.841777337Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}