Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow SFTP provider before 7.0.0 Description: The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle...
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/174
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
Posted by Hussein Awala on Oct 26 Severity: low Affected versions: - Apache Airflow SSH provider 4.3.0 before 7.0.1 Description: In apache-airflow-providers-ssh before…
CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow SSH provider before 7.0.0 - Apache Airflow SFTP provider before 7.0.0…
OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing
The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have…
Announce: OpenSSH 10.6 released
Posted by Damien Miller on Oct 06 OpenSSH 10.6 has just been released. It will be available from the mirrors listed at https://www.openssh.com/ shortly. OpenSSH is a…
CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap
Posted by Thomas Wolf on Sep 29 Severity: critical CVSS 3.1: 9.1 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected versions: - Apache MINA SSHD 1.2.0…
CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
Posted by Thomas Wolf on Sep 29 Severity: moderate CVSS 3.1: 7.5 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected versions: - Apache MINA SSHD 0.9.0 before…