CVE-2026-45361

The record

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.

Affected packages

Related vulnerabilities

• CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because… CWE-322
• CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync… CWE-322
• CVE-2026-107675 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the… CWE-322
• CVE-2026-18654 Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS… CWE-322
• CVE-2026-11745 A vulnerability has been identified in centraldogma-server-mirror-git versions prior to… CWE-322
• GHSA-mxg3-432p-mr72 goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled… CWE-322
• CVE-2026-44467 The Claude Desktop app gives you Claude Code with a graphical interface built for running… CWE-322
• CVE-2026-1354 Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a… CWE-322