CVE-2026-94134 | Apache Airflow SSH Provider/Airflow SFTP Provider up to 6.x SSH Hook/SFTP Hook host_key/no_host_key_check certificate validation

October 16, 2026 Yanac

A vulnerability classified as problematic has been found in Apache Airflow SSH Provider and Airflow SFTP Provider up to 6.x. Affected by this issue is some unknown functionality of the component SSH Hook/SFTP Hook. Performing a manipulation of the argument host_key/no_host_key_check results in improper certificate validation.

This vulnerability was named CVE-2026-94134. The attack may be initiated remotely. There is no available exploit.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More