The Apache Airflow SSH provider and SFTP provider default to disabling SSH host‑key verification. Unless a host_key is supplied or no_host_key_check is explicitly set to false, the hook accepts any server key. This flaw allows a man‑in‑the‑middle attacker positioned between a worker and the SSH or SFTP server to impersonate the server, intercept traffic, and capture credentials or data transmitted by Airflow tasks. The impact is the compromise of authentication information and potential exfiltration of exchanged data.

Apache Software Foundation products Apache Airflow SSH provider and Apache Airflow SFTP provider are affected. The flaw exists in current releases that ship these providers without mandatory host‑key verification. Users of the airflow packages apache‑airflow‑providers‑ssh and apache‑airflow‑providers‑sftp should check the version and upgrade if they are using a version prior to 7.0.0.

The CVSS score of 9.1 indicates high severity, while the EPSS score is < 1% and it is not listed in KEV. Because the hook disables host‑key verification by default, a straightforward man‑in‑the‑middle attack can be performed against unauthenticated network traffic without advanced privileges. The risk is high for deployments that do not explicitly enable host‑key verification. An attacker can capture credentials or sensitive data, potentially enabling further access to downstream resources.