Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1040 _____________________________________________________________________ DATE : 16/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Airflow SSH provider versions prior to 7.0.0, Apache Airflow Keycloak provider versions prior to 0.11.1, Apache Airflow SFTP provider versions prior to 7.0.0. ==================================================================== https://lists.apache.org/thread.html/x8r9fx6cp843kfhk4t2ssy3bg6r1w3yd https://lists.apache.org/thread.html/4sts8ml33qd0nnxwcmz21x0bc44oc6yv https://lists.apache.org/thread.html/36j2zrr5ty1jg69yq5zl7on4nb71qtd9 https://lists.apache.org/thread.html/2x3hrkkj42ph5y2pvv64vmk0hfqnj99b _____________________________________________________________________ CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Severity: moderate Affected versions: - Apache Airflow SSH provider before 7.0.0 - Apache Airflow SFTP provider before 7.0.0 Description: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both. Credit: Claude Security Scans (tool) Igor Stepansky, OX Security (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/73419 https://www.cve.org/CVERecord?id=CVE-2026-94135 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-94134 _____________________________________________________________________ CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read Severity: important Affected versions: - Apache Airflow Keycloak provider before 0.11.1 Description: The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later. Credit: OpenSec Intelligence (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/73696 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-92228 _____________________________________________________________________ CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token Severity: moderate Affected versions: - Apache Airflow Keycloak provider before 0.11.1 Description: The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later. Credit: JelyFishhhhhh (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/73695 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-96806 _____________________________________________________________________ CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default Severity: moderate Affected versions: - Apache Airflow SFTP provider before 7.0.0 Description: The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both. Credit: Claude Security Scans (tool) Igor Stepansky, OX Security (finder) Jarek Potiuk (remediation developer) References: https://github.com/apache/airflow/pull/73419 https://www.cve.org/CVERecord?id=CVE-2026-94134 https://airflow.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-94135 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================