{"metadata": {"vulnerability": "cve-2026-94134", "count": 17, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-20T18:23:05.037Z", "date_only": false, "value": "2026-09-20T18:23:05.037Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-94134", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T21:39:03.081Z", "date_only": false, "value": "2026-10-15T21:39:03.081Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-94134", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T22:21:12Z", "date_only": false, "value": "2026-10-15T22:21:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P86C-663X-5PXQ", "record": "GHSA-P86C-663X-5PXQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T22:21:12.023Z", "date_only": false, "value": "2026-10-15T22:21:12.023", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94134", "record": "FKIE_CVE-2026-94134", "field": "published"}, {"timestamp": "2026-10-15T22:22:23.869Z", "date_only": false, "value": "2026-10-15T22:22:23.869099Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117447258500975166", "record": "CVE-2026-94134", "field": "creation_timestamp", "uuid": "95f4287b-48bb-4796-9483-7468b7259b03", "content": "CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends.\nUsers of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94134https://github.com/apache/airflow/pull/73419https://www.cve.org/CVERecord?id=CVE-2026-94135#cve #ApacheSoftwareFoundation #ApacheAirflowSSHprovider #ApacheAirflowSFTPprovider#CVE_2026_94134#bot", "url": "https://infosec.exchange/users/cve/statuses/117447258500975166"}, {"timestamp": "2026-10-15T22:23:04.292Z", "date_only": false, "value": "2026-10-15T22:23:04.292747Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117447261141749426", "record": "CVE-2026-94134", "field": "creation_timestamp", "uuid": "d73496b6-1218-4e0a-a22b-890b698b1b9f", "content": "CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged.\nUsers of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94135https://github.com/apache/airflow/pull/73419https://www.cve.org/CVERecord?id=CVE-2026-94134#cve #ApacheSoftwareFoundation #ApacheAirflowSFTPprovider#CVE_2026_94135#bot", "url": "https://infosec.exchange/users/cve/statuses/117447261141749426"}, {"timestamp": "2026-10-15T23:41:21.218Z", "date_only": false, "value": "2026-10-15T23:41:21.218174Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/cf5jdm3k4pnp7", "record": "CVE-2026-94134", "field": "creation_timestamp", "uuid": "69be91a6-22aa-48cd-87de-cd98b77a771b", "content": "CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/cf5jdm3k4pnp7"}, {"timestamp": "2026-10-16T00:31:59Z", "date_only": false, "value": "2026-10-16T00:31:59Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P86C-663X-5PXQ", "record": "GHSA-P86C-663X-5PXQ", "field": "published"}, {"timestamp": "2026-10-16T03:39:17.565Z", "date_only": false, "value": "2026-10-16T03:39:17.565Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "cve-2026-94134", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:53:40.519Z", "date_only": false, "value": "2026-10-16T14:53:40.519965Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-94134", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-16T14:53:40.519Z", "date_only": false, "value": "2026-10-16T14:53:40.519965Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94134", "record": "FKIE_CVE-2026-94134", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T14:53:59.032Z", "date_only": false, "value": "2026-10-16T14:53:59.032Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-94134", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T14:53:59.032Z", "date_only": false, "value": "2026-10-16T14:53:59.032Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-94134", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:16:39.930Z", "date_only": false, "value": "2026-10-16T15:16:39.930240Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mxyune2ba42r", "record": "CVE-2026-94134", "field": "creation_timestamp", "uuid": "2dce3cdb-b3a0-48d2-8116-b9eec7d13abd", "content": "CVE-2026-94134: Apache Airflow SSH and SFTP providers disable SSH host-key verification by default, letting a machine-in-the-middle attacker impersonate the server and capture credentials, per the Apache Software Foundation. Fixed in both providers at 7.0.0.", "url": "https://bsky.app/profile/suriq.io/post/3mxyune2ba42r"}, {"timestamp": "2026-10-16T15:20:39.130Z", "date_only": false, "value": "2026-10-16T15:20:39.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94134", "record": "FKIE_CVE-2026-94134", "field": "lastModified"}, {"timestamp": "2026-10-16T15:30:04.823Z", "date_only": false, "value": "2026-10-16T15:30:04.823167Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxyvfdltws2r", "record": "CVE-2026-94134", "field": "creation_timestamp", "uuid": "7a409721-a6aa-45d3-be3e-451b3637c66d", "content": "CVE-2026-94134 - apache airflow ssh provider\nThe SSH and SFTP connection tools that come with Apache Airflow do not check the server\u2019s identity unless you specifically configure a host key or turn off the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachefoundation #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxyvfdltws2r"}, {"timestamp": "2026-10-16T15:38:29Z", "date_only": false, "value": "2026-10-16T15:38:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P86C-663X-5PXQ", "record": "GHSA-P86C-663X-5PXQ", "field": "modified"}]}