Vulnerabilities of Apache Software Foundation Apache Airflow SFTP provider
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-94135 | The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable… | Not rated | Oct 15, 2026 |
| CVE-2026-94134 | The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or… | Not rated | Oct 15, 2026 |
| CVE-2026-50203 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or… | Not rated | Jun 17, 2026 |