CVE-2026-45361
published 2026-05-25CVE-2026-45361: Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a…
PriorityP349high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
0.59%
44.2th percentile
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apache-airflow-providers-google | < 22.0.0 | 22.0.0 |
| apache | apache-airflow-providers-google | >= 0 < 22.0.0 | 22.0.0 |
| apache_software_foundation | apache_airflow_google_provider | < 22.0.0 | 22.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g9v5-gjwf-9rwx: Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker
ghsa_unreviewed·2026-05-26
CVE-2026-45361 [HIGH] CWE-322 GHSA-g9v5-gjwf-9rwx: Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
GHSA
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default
ghsa·2026-05-26
CVE-2026-45361 [HIGH] CWE-322 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
CVEList
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
cvelistv5·2026-05-25
CVE-2026-45361 CWE-322 Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
VulDB
Apache Airflow Google Provider up to 21.x SSH Host-Key Verification key exchange without entity authentication (EUVD-2026-31659)
vuldb·2026-05-25
CVE-2026-45361 [LOW] Apache Airflow Google Provider up to 21.x SSH Host-Key Verification key exchange without entity authentication (EUVD-2026-31659)
A vulnerability, which was classified as problematic, was found in Apache Airflow Google Provider up to 21.x. Affected by this vulnerability is an unknown functionality of the component SSH Host-Key Verification. Such manipulation leads to key exchange without entity authentication.
This vulnerability is documented as CVE-2026-45361. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-25
Published