Read the docs
TI-2026-33152 Aliases CVE-2026-45361GHSA-g9v5-gjwf-9rwx

Apache Airflow Google provider: SSH host key verification disabled in…

Priority LOW 38CWE-322Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0059 48th percentileScored 2026-11-07
Fix Fixed Apache Airflow Google provider (Apache Software Foundation): 22.0.0apache-airflow-providers-google (PyPI): 22.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Airflow Google providerbefore 22.0.022.0.0Patch availableCNA
—apache-airflow-providers-google (PyPI)before 22.0.022.0.0Patch availableGHSA-g9v5-gjwf-9rwx
  • Apache Airflow Google provider VendorApache Affected before 22.0.0 Fixed in 22.0.0 Patch available CNA
  • apache-airflow-providers-google (PyPI) Vendor— Affected before 22.0.0 Fixed in 22.0.0 Patch available GHSA-g9v5-gjwf-9rwx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apache-airflow-providers-google:*:*:*:*:*:*:*:*before 22.0.0VulnerableApache
  • cpe:2.3:a:apache:apache-airflow-providers-google:*:*:*:*:*:*:*:* Versions before 22.0.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Airflow Google provider (Apache Software Foundation) Fixed in 22.0.0
  • Fix · GHSA-g9v5-gjwf-9rwx apache-airflow-providers-google (PyPI) Fixed in 22.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45361
  2. 2026-10-03 Alias added: GHSA-g9v5-gjwf-9rwx
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 3

Other 4

  • TI-2023-10968 Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution CVSS 3.1CRITICAL 9.8
  • TI-2023-10969 Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service CVSS 3.1HIGH 7.5
  • TI-2026-36483 Path traversal in Apache Airflow Google provider CVSS 3.1HIGH 8.1
  • TI-2026-48427 Apache Airflow Google provider: google Secret Manager backend: team scope is never… CVSS 3.1MEDIUM 6.5
  • TI-2026-56525 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences