Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Apache Airflow SFTP provider 7.0.0 Clear all filters
TI-2026-75102 CVE-2026-94135 · GHSA-65q9-82jj-rffc

Apache Airflow SFTP provider disables host-key checks by default

Priority LOW 20

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0038 Published 2026-10-15 Fixed in 7.0.0 CWE-322
TI-2026-75101 CVE-2026-94134 · GHSA-p86c-663x-5pxq

Apache Airflow SSH and SFTP providers skip host-key checks by default

Priority MEDIUM 46

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.006 Published 2026-10-15 Fixed in 7.0.0 CWE-322