Executive brief
The Apache Airflow Git provider, which manages code synchronization from Git repositories, was found to disable security checks when connecting to servers via SSH. This flaw allows an attacker who can intercept network traffic to impersonate a Git server, potentially stealing sensitive access keys or injecting malicious code into the Airflow environment. Organizations using SSH-based Git synchronization should update the provider to ensure secure server verification.
Technical details
The Apache Airflow Git provider (apache-airflow-providers-git) was configured with `StrictHostKeyChecking=no` and pointed the `known_hosts` file to `/dev/null` by default. This configuration disables SSH host-key verification, enabling a Man-in-the-Middle (MitM) attacker to impersonate the Git server. An attacker with network-level access can capture SSH deploy keys or serve malicious repository content (such as poisoned DAGs) to Airflow workers. The vulnerability is addressed in version 0.4.1, which changes the default behavior to 'accept-new' and eventually 'yes', requiring operators to properly configure a `known_hosts` file.
Affected products
- Apache Software Foundation Apache Airflow Git provider (apache-airflow-providers-git) < 0.4.1
Timeline
- 2026-06-28: patched: Pull request merged to fix host key verification.
- 2026-07-13: disclosed: CVE-2026-58065 published.