Apache Software Foundation Apache Airflow SFTP provider

• CVE-2026-94135 Medium 4.3 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default 0.4%
• CVE-2026-94134 Critical 9.1 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default 0.6%
• CVE-2026-50203 Critical 9.1 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names 0.6%