Apache Airflow Sftp Provider (Apache Software Foundation) - vulnerabilities (CVEs)

3 CVEs, 2 in the last 30 days, 2 known versions, newest CVE from 2026-10-15. Vendor: Apache Software Foundation.

CVEs of Apache Airflow Sftp Provider

• CVE-2026-94135 - CVSS 4.3 (medium), 2026-10-15: The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default…
• CVE-2026-94134 - CVSS 9.1 (critical), 2026-10-15: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set…
• CVE-2026-50203 - CVSS 9.1 (critical), 2026-06-17: A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write…