VulnSocial

CVE-2026-58065Disclosure(apache / apache-airflow-providers-git)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-322

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • apache-airflow-providers-git

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-13); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
apache
Products
apache-airflow-providers-git

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-13: 3Mentions · 2026-07-14: 1Technical Details · 2026-07-13: 307-1307-14
Signal classification1 categories
Disclosure
4100.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-07-133
Disclosure3
2026-07-141
Disclosure1
Full discourse4 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no https://www.openwall.com/lists/oss-security/2026/07/13/3 CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission https://www.openwall.com/lists/oss-security/2026/07/13/4

    Post summary

    Two new Apache Airflow CVEs were disclosed, one involving a default SSH host key check setting and another involving permission hijacking via a DAG named 'DAGs', with no PoC, exploit, or patch information provided.

    00020570
    4.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-58065 The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can … https://www.cve.org/CVERecord?id=CVE-2026-58065

    Post summary

    The post notes that Apache Airflow’s Git provider disables SSH host‑key verification by default, a vulnerability that could allow man‑in‑the‑middle attacks.

    00010662
    57.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-58065 Man-in-the-Middle Vulnerability in Apache Airflow Git Provider SSH Operations https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58065

    Post summary

    The note announces a Man-in-the-Middle flaw in Apache Airflow's Git provider SSH operations, providing minimal detail and no indication of exploitation or mitigation.

    0000083
    4.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-58065 The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can … https://www.cve.org/CVERecord?id=CVE-2026-58065 ----- Traducción: CVE-2026-58065 El … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-58065, describing how Apache Airflow's default SSH configuration disables host‑key verification.

    0000039
    92 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheapache-airflow-providers-git---

Explore more

Back to dashboardapache CVEsapache-airflow-providers-git vulnerabilities