Apache Airflow Git provider: SSH host-key verification disabled by default when cloning DAG bundles

Impact

The Git provider runs its git-over-SSH operations with StrictHostKeyChecking=no, so an Airflow worker will accept any host key presented for the Git server. An attacker on the network path between the worker and the Git server can impersonate the server, capture the SSH deploy key, and serve modified repository content. Since the Git DAG bundle is how Airflow workers obtain the code they execute, injected repository content becomes arbitrary code running on the scheduler and worker pods - the same pods that hold pipeline credentials and, in ML fleets, submit and control GPU jobs. The stolen deploy key also gives persistent access to the repository itself.

Who can reach it

Network, no authentication - requires a machine-in-the-middle position between Airflow workers and the Git server (a shared or untrusted network segment, DNS or routing control). Affects deployments that clone over SSH with a deploy key using the Git DAG bundle or Git provider.

What to do

Upgrade apache-airflow-providers-git to 0.4.1 or later, which verifies host keys by default, and supply a known_hosts file for the Git server - the upgrade alone does nothing without that file. A provider package upgrade plus a restart of schedulers and workers; no node reboot. Treat any deploy key that was in use as potentially exposed and rotate it.

References

Related entries

• Apache Airflow FAB provider: a DAG named 'DAGs' collides with the global all-DAGs permission and escalates privilegesCVE-2026-59245 · Apache Airflow FAB auth manager (apache-airflow-providers-fab, resource_name collision)High
• Linux MACsec (replay protection at XPN lower-PN wrap): MACsec replay protection fails at the extended-packet-numberCVE-2026-63925 · Linux MACsec (replay protection at XPN lower-PN wrap)High
• Atlantis: workspace names escape the working directory into os.RemoveAll and os.MkdirAllCVE-2026-64679 · Atlantis (workspace path handling in atlantis.yaml and /api/plan)High
• Dell PowerStore T SDNAS: unauthenticated NFS/RPC buffer overflow allows command execution on the arrayCVE-2026-70415 · Dell PowerStore T SDNAS (NFS/RPC service)High
• Jenkins: inconsistent case handling in user and group names allows impersonation of other accountsCVE-2026-70429 · Jenkins core (user and group name case-sensitivity handling)High
• Ansible community.general: memcached fact cache unpickles values, giving code execution on the controllerCVE-2026-87874 · Ansible community.general collection (memcached fact cache plugin)High