Apache Software Foundation Apache Airflow Sftp Provider vulnerabilities

2 CVEs affecting Apache Software Foundation Apache Airflow Sftp Provider, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94135, published 2026-10-15.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-94134, published 2026-10-15. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This…
• CVE-2026-94135, published 2026-10-15. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets…