{"metadata": {"vulnerability": "CVE-2026-94135", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-20T18:23:25.118Z", "date_only": false, "value": "2026-09-20T18:23:25.118Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94135", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T21:40:24.810Z", "date_only": false, "value": "2026-10-15T21:40:24.810Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94135", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T22:21:12Z", "date_only": false, "value": "2026-10-15T22:21:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-65Q9-82JJ-RFFC", "record": "GHSA-65Q9-82JJ-RFFC", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T22:21:12.140Z", "date_only": false, "value": "2026-10-15T22:21:12.140", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94135", "record": "FKIE_CVE-2026-94135", "field": "published"}, {"timestamp": "2026-10-15T22:22:23.889Z", "date_only": false, "value": "2026-10-15T22:22:23.889493Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117447258500975166", "record": "CVE-2026-94135", "field": "creation_timestamp", "uuid": "dd8f8908-731d-4f34-b1d0-0826452eb770", "content": "CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.\nUsers of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94134https://github.com/apache/airflow/pull/73419https://www.cve.org/CVERecord?id=CVE-2026-94135#cve #ApacheSoftwareFoundation #ApacheAirflowSSHprovider #ApacheAirflowSFTPprovider#CVE_2026_94134#bot", "url": "https://infosec.exchange/users/cve/statuses/117447258500975166"}, {"timestamp": "2026-10-15T22:23:04.238Z", "date_only": false, "value": "2026-10-15T22:23:04.238712Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117447261141749426", "record": "CVE-2026-94135", "field": "creation_timestamp", "uuid": "f32e23cf-8836-4367-b33a-f31697778d4d", "content": "CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94135https://github.com/apache/airflow/pull/73419https://www.cve.org/CVERecord?id=CVE-2026-94134#cve #ApacheSoftwareFoundation #ApacheAirflowSFTPprovider#CVE_2026_94135#bot", "url": "https://infosec.exchange/users/cve/statuses/117447261141749426"}, {"timestamp": "2026-10-15T23:47:21.703Z", "date_only": false, "value": "2026-10-15T23:47:21.703002Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/5jqbewxwmfghu", "record": "CVE-2026-94135", "field": "creation_timestamp", "uuid": "220c97d2-e73a-44dd-a151-5b0d9dc014ed", "content": "CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/5jqbewxwmfghu"}, {"timestamp": "2026-10-16T00:31:59Z", "date_only": false, "value": "2026-10-16T00:31:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-65Q9-82JJ-RFFC", "record": "GHSA-65Q9-82JJ-RFFC", "field": "published"}, {"timestamp": "2026-10-16T03:39:13.211Z", "date_only": false, "value": "2026-10-16T03:39:13.211Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-94135", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:46:17.150Z", "date_only": false, "value": "2026-10-16T14:46:17.150791Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94135", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-16T14:46:17.150Z", "date_only": false, "value": "2026-10-16T14:46:17.150791Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94135", "record": "FKIE_CVE-2026-94135", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T14:46:22.385Z", "date_only": false, "value": "2026-10-16T14:46:22.385Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94135", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:46:22.385Z", "date_only": false, "value": "2026-10-16T14:46:22.385Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94135", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:20:39.130Z", "date_only": false, "value": "2026-10-16T15:20:39.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94135", "record": "FKIE_CVE-2026-94135", "field": "lastModified"}, {"timestamp": "2026-10-16T15:38:29Z", "date_only": false, "value": "2026-10-16T15:38:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-65Q9-82JJ-RFFC", "record": "GHSA-65Q9-82JJ-RFFC", "field": "modified"}]}