{"id":"CVE-2026-94135","aliases":["EUVD-2026-102523","GHSA-65q9-82jj-rffc"],"status":"published","title":"Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default","description":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\n\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0038,"percentile":0.324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-322"],"published":"2026-10-15T21:40:24Z","modified":"2026-11-11T02:49:07Z","products":[{"vendor":"apache software foundation","product":"apache airflow sftp provider"}],"references":[{"url":"https://github.com/apache/airflow/pull/73419","tags":["patch","fix"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94134","tags":["related","web"]},{"url":"https://lists.apache.org/thread/jbzs97t9y1zd1yp5rvxzjbx90mqz82kf","tags":["vendor-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94135","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-65q9-82jj-rffc"},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94135.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-94135","title":"Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default","description":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\n\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.","status":"published","published":"2026-10-15T21:40:24.81Z","modified":"2026-10-16T14:46:22.385Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-102523","description":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\n\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.","status":"published","published":"2026-10-15T21:40:24Z","modified":"2026-10-16T14:46:22Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:00:05.596619Z"}],"ghsa":[{"id":"GHSA-65q9-82jj-rffc","title":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, ...","description":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\n\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.","status":"published","published":"2026-10-16T00:31:59Z","modified":"2026-10-16T15:38:30Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T15:13:51.736258Z"}],"nvd":[{"id":"CVE-2026-94135","description":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\n\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.","status":"published","published":"2026-10-15T22:21:12.14Z","modified":"2026-10-16T15:20:39.13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"CVE-2026-94135","title":"Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default","description":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\n\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.","status":"published","published":"2026-10-15T21:40:24.81Z","modified":"2026-11-11T02:49:07.418870719Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-322"],"updated_at":"2026-11-11T03:21:16.313764Z"}]}}