Apache Software Foundation Apache Airflow SSH Provider vulnerabilities

1 CVE affecting Apache Software Foundation Apache Airflow SSH Provider, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94134, published 2026-10-15.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-94134, published 2026-10-15. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This…