Not rated
CVE-2026-45361 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH…
Description
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Airflow Google Provider 22.0 | earliest → < 22.0.0 | 22.0.0 |
Other CVEs of Apache Airflow Google Provider
The 6 CVEs of Apache Airflow Google Provider →
CVE-2026-81914
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly…
Not rated
CVE-2026-68868
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when…
Not rated
CVE-2026-49297
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS…
Not rated
CVE-2023-25692
Improper Input Validation vulnerability in the Apache Airflow Google Provider
Not rated