PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45361 Apache Software Foundation CVE debrief

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. The vulnerability stems from the hook's default configuration that skips host-key verification, allowing man-in-the-middle attacks against SSH connections. This affects automated workflows that use the Google Cloud provider to manage Compute Engine instances via SSH. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability with network attack vector and high attack complexity. The fix was implemented in apache-airflow-providers-google version 22.0.0.

Vendor
Apache Software Foundation
Product
Apache Airflow Google provider
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-21
Advisory published
2026-05-25
Advisory updated
2026-07-21

Who should care

Organizations running Apache Airflow with Google Cloud provider integrations for Compute Engine management; DevOps and data engineering teams managing cloud infrastructure automation; security teams monitoring SSH security posture in cloud-native data pipelines; compliance teams assessing cryptographic authentication controls in automated workflows.

Technical summary

The `ComputeEngineSSHHook` in apache-airflow-providers-google versions prior to 22.0.0 defaults to disabling SSH host-key verification. This configuration allows network-positioned attackers to perform man-in-the-middle attacks against SSH sessions between Airflow workers and Google Compute Engine VMs, potentially intercepting credentials, exfiltrating data, or executing unauthorized commands. The vulnerability is classified as CWE-322 (Key Exchange without Entity Authentication). The attack requires network access to the communication path but no user interaction or privileges. Resolution requires upgrading to version 22.0.0 or explicitly enabling host-key verification in hook configurations.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade apache-airflow-providers-google to version 22.0.0 or later
  • Review existing Airflow DAGs using ComputeEngineSSHHook for SSH host-key verification configuration
  • Enable strict host-key verification in ComputeEngineSSHHook configurations where not already enforced
  • Audit network paths between Airflow workers and Compute Engine VMs for potential interception points
  • Monitor for anomalous SSH connection patterns or unexpected host-key changes in production environments

Evidence notes

CVE published 2026-05-25; modified 2026-05-26. NVD status: Undergoing Analysis. Weakness: CWE-322 (Key Exchange without Entity Authentication). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45361 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45361

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45361 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45361

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.