CVE-2026-94135 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Airflow deployments using the SFTP provider should assess exposure and prioritize upgrading to apache-airflow-providers-sftp 7.0.0 or later. Security teams and vulnerability management teams should review SFTP sensor and operator configurations to ensure host-key verification is enabled. Operators and administrators of Apache Airflow deployments using the SFTP provider should also be aware of this vulnerability and take the

Why it matters

CVE-2026-94135 is a vulnerability in the Apache Airflow SFTP provider's deferrable code paths, which disable SSH host-key verification by default. This allows for potential impersonation and credential capture by an attacker in a machine-in-the-middle position. Defenders should prioritize upgrading to apache-airflow-providers-sftp 7.0.0 or later and review SFTP sensor and operator configurations to ensure host-key verification is enabled.

• Potential impersonation of SFTP server by an attacker in a machine-in-the-middle position
• Possible capture of credentials or data exchanged between the triggerer and the SFTP server
• Verification of host-key verification configuration for SFTP sensors and operators
• Upgrade to apache-airflow-providers-sftp 7.0.0 or later to address the vulnerability

Technical summary

The Apache Airflow SFTP provider's deferrable code paths disable SSH host-key verification by default, allowing for potential impersonation and credential capture by an attacker in a machine-in-the-middle position. This vulnerability affects deployments running SFTP sensors or operators in deferrable mode, unless the connection explicitly sets no_host_key_check to false. The deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) are impacted by this vulnerability. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later.

Defensive priority

Defenders should prioritize upgrading to apache-airflow-providers-sftp 7.0.0 or later to address the vulnerability.

Recommended defensive actions

• Upgrade to apache-airflow-providers-sftp 7.0.0 or later
• Review and update SFTP sensor and operator configurations to ensure host-key verification is enabled
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected deployments and specific exploitation attempts are not documented. Evidence is limited to the information provided in the CVE record and NVD entry. Defenders should verify the configuration of SFTP sensors and operators to ensure host-key verification is enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.