CVE-2026-58065 Details
Description
The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.
A vulnerability exists in the Apache Airflow Git provider, specifically in versions prior to 0.4.1, where git-over-SSH operations are performed with 'StrictHostKeyChecking=no' by default. This setting disables SSH host-key verification, leaving deployments open to man-in-the-middle attacks. An attacker intercepting the network path between an Airflow worker and the Git server could impersonate the server, potentially capturing the SSH deploy key or injecting malicious content into repositories. This issue affects deployments using the Git DAG bundle or the Git provider to clone repositories over SSH with a deploy key.
To address this vulnerability, users should upgrade to version 0.4.1 or later of the Apache Airflow Git provider and configure a 'known_hosts' file to verify SSH host keys.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/13/3 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/69103 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/fjmclngfksz2kp7llpcjxzdz568h0zhc | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-322 | Key Exchange without Entity Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-git | < 0.4.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | [email protected] |
| Sep 16, 2026 | CVE Modified | CVE |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CVE |
| Jul 13, 2026 | New CVE Received | [email protected] |