- Description
- The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.
- Source
- security@apache.org
- NVD status
- Modified
- Products
- apache-airflow-providers-git
CVSS 3.1
- Type
- Primary
- Base score
- 8.1
- Impact score
- 5.9
- Exploitability score
- 2.2
- Vector string
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@apache.org
- CWE-322
- Hype score
- Not currently trending
CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no https://t.co/z5nx2kB5Aw CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission https://t.co/RQyMJs4nh9
@oss_security
14 Jul 2026
483 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨*CVE* CVE-2026-58065 The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can … https://t.co/co7nwDMmTO ----- Traducción: CVE-2026-58065 El … https://t.co/utmtNg
@infoflowcloud
13 Jul 2026
37 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:apache-airflow-providers-git:*:*:*:*:*:*:*:*",
"matchCriteriaId": "25DB8B13-B0BE-4AA4-B47A-D30A6507E6A0",
"versionEndExcluding": "0.4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]