News
threat-intel Researchers Demonstrate iOS 27.0.1 Untethered Jailbreak on iPhone 18 Pro - GBHackers threat-intel Progress Warns of MOVEit Transfer Vulnerabilities Allowing Authentication Bypass and Privilege Escalation - GBHackers cybersecurity In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit - SecurityWeek cybersecurity By Default, Insecure: Apache Airflow Disables SSH Host Key Verification - OX Security cybersecurity When Your Ransomware Negotiator Works for the Other Side - Dark Reading cybersecurity When AI Agents Commit Breaches, Humans May Not Be Held Liable - Dark Reading threat-intel MITRE ATT&CK v20 Adds New AI Attack Techniques for Prompt Injection and Data Theft - GBHackers cybersecurity iOS 27.0.1 Jailbreak Survives Reboot and Restores Root Access on iPhone 18 Pro - CyberPress threat-intel Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs - GBHackers cybersecurity Multiple MOVEit Transfer Flaws Could Let Attackers Bypass MFA and Access Sensitive Data - CyberPress ai The Download: failed social media bans, and extending pets’ lives - MIT Technology Review cybersecurity Burger King Japan data breach exposes 11 million customer records - BleepingComputer cybersecurity MITRE ATT&CK Adds New AI Attack Techniques Covering Prompt Injection and Data Theft - CyberPress cybersecurity BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts - SecurityWeek cybersecurity AI Decision Models and Their Impact on AI SOC Platforms - The Hacker News
1 / 15
All news ›
Cybersecurity

By Default, Insecure: Apache Airflow Disables SSH Host Key Verification

OX Security ·

Vulnerability Details CVE-2026-94134 – SSH hook default, both providers CVE-2026-94135 – Async SFTP path Severity: High – CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CWE: CWE-322 (Key Exchange without Entity Authentication) Affected packages: apache-airflow-providers-ssh and apache-airflow-providers-sftp – both through version 6.0.1 Fixed in: apache-airflow-providers-ssh 7.0.0 (CVE-2026-94134), apache-airflow-providers-sftp 7.0.0 (CVE-2026-94135) Overview OX Security Research discovered that Apache Airflow disables SSH […] The post By Default, Insecure: Apache Airflow Disables SSH Host Key Verification appeared first on OX Security .

Continue on OX Security ↗ ‹ All news