apache-airflow-providers-sftp vulnerabilities

CVEs whose affected-version data names the apache-airflow-providers-sftp package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-94134Critical· 9.1PoC

1w ago

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that …

▾ AbyssalApache Software Foundation · apache-airflow-providers-sshEPSS 0.60%via NVD

CVE-2026-94135Medium· 4.3

1w ago

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that…

▾ SunlitApache Software Foundation · apache-airflow-providers-sftpEPSS 0.38%via NVD

CVE-2026-50203Critical· 9.1

4mo ago

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

▾ Midnightapache-airflow-providers-sftp · apache-airflow-providers-sftpEPSS 0.63%via OSV