OX Security said on 16 October that Apache Airflow's SSH and SFTP add-on packages skip a key safety check by default. Airflow is open-source software that teams use to schedule data jobs. The check confirms a remote server is really the one it claims to be. Without it, an attacker on the network path can pose as that server. OX Security says the attacker could then steal credentials, alter transferred files, or send data elsewhere. It lists two High-severity CVEs: CVE-2026-94134 and CVE-2026-94135. The first has a CVSS score of 8.1. The packages apache-airflow-providers-ssh and apache-airflow-providers-sftp are affected through version 6.0.1. Version 7.0.0 of each fixes the problem.
OX Security says users do not need to change any setting to be exposed. Checking is off unless they turn it on. The only sign is a log warning written after the connection opens. The firm suggests setting no_host_key_check to false on each connection and supplying a host key. Connections without a key will then fail, which OX calls correct behaviour. The source does not say whether anyone has used the flaw in a real attack. It also notes both CVE entries are reserved and will publish with the advisory. It gives no statement from the Airflow project.
Teams running Airflow pipelines that reach production servers over SSH or SFTP may have the check off without ever choosing that. OX Security's fixes are upgrading to 7.0.0 or setting the option on every existing connection. If interception is suspected, it advises rotating the stored credentials.