What’s Vulnerable › Products

Apache Software Foundation Apache Airflow SFTP provider vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your Apache Software Foundation Apache Airflow SFTP provider version is affected

Latest Apache Software Foundation Apache Airflow SFTP provider vulnerabilities

• CVE-2026-94135 — Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default (CVSS 4.3)
• CVE-2026-94134 — Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default (CVSS 9.1)
• CVE-2026-50203 — Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names (CVSS 9.1)