apache-airflow-providers-ssh vulnerabilities
CVEs whose affected-version data names the apache-airflow-providers-ssh package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111422NoneApache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` i…
▾ SunlitApache Software Foundation · apache-airflow-providers-sshEPSS 0.27%via CVEORG
CVE-2026-94134Critical· 9.1PoCThe Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that …
▾ AbyssalApache Software Foundation · apache-airflow-providers-sshEPSS 0.60%via NVD