Log in Start free

Vulnerability · Published May 25, 2026 · Assigned by apache

CVE-2026-45361Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)

High 8.1

In plain English

A high-severity security flaw in Apache Airflow Google provider from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIapache-airflow-providers-google22.0.0GHSA-g9v5-gjwf-9rwx
PyPIapache-airflow-providers-google22.0.0PYSEC-2026-166

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Airflow Google provider 0 – before 22.0.0

Weakness: CWE-322 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References