Apache Airflow SSH/SFTP providers: host-key checking off by default, so workers trust any server key

Impact

The Airflow SSH and SFTP provider hooks accepted any server host key unless host_key was configured or no_host_key_check was explicitly set to false, so every connection relying on the default had no server authentication at all. Anyone in a machine-in-the-middle position between an Airflow worker and the target SSH or SFTP server can impersonate that server and capture whatever the task sends - commonly the credentials and data pipelines use to reach storage and training nodes. On a GPU fleet Airflow workers are typically the component that pushes datasets, checkpoints and job submissions around, so the harvested credentials often unlock more than the one connection. The deferrable SFTP code paths carried the same default and are tracked separately as CVE-2026-94135, which is not in this batch; the sftp provider 7.0.0 release fixes both.

Who can reach it

An attacker with a machine-in-the-middle position on the network path between an Airflow worker and the SSH or SFTP endpoint it connects to - for example anyone who can spoof DNS or ARP on that segment. No Airflow credentials are required; the worker initiates the connection.

What to do

Upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later, which require host-key verification, then populate host_key (or a known_hosts path) on every SSH and SFTP connection before cutting over, since connections relying on the old default will now fail. The rollout is a provider package upgrade plus a restart of schedulers, workers and triggerers - no node reboot - but budget time for the connection inventory. Treat any credential that previously flowed over an unverified connection as potentially exposed and rotate it.

References

Related entries

• AMD EPYC / Ryzen - Hardware Validated Boot enforcement: Hardware Validated Boot is not properly enforced, so anCVE-2018-8930 · AMD EPYC / Ryzen - Hardware Validated Boot enforcementCritical
• AMD EPYC Server - protected memory region access control: Insufficient access control over protected memory regions onCVE-2018-8933 · AMD EPYC Server - protected memory region access controlCritical
• PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigation: Non-uniform Rowhammer patterns triggered bit flips on every oneCVE-2021-42114 · PC-DDR4 / LPDDR4X DRAM - Target Row Refresh mitigationCritical
• Digi RealPort protocol (Digi console/terminal servers): RealPort is the protocol Digi console servers use to exposeCVE-2023-4299 · Digi RealPort protocol (Digi console/terminal servers)Critical
• Ivanti Connect Secure: Stack-based buffer overflowCVE-2025-0282 · Ivanti Connect SecureCritical
• Ivanti Connect Secure/ZTA: Stack-based buffer overflowCVE-2025-22457 · Ivanti Connect Secure/ZTACritical