CVE-2026-58065: Airflow Git Provider Info Disclosure Flaw

CVE-2026-58065 Overview

CVE-2026-58065 affects the Apache Airflow Git provider, which performs git-over-SSH operations with StrictHostKeyChecking=no by default. This configuration disables SSH host-key verification, exposing worker-to-Git-server communication to man-in-the-middle (MITM) attacks. An attacker positioned on the network path between an Airflow worker and the Git server can impersonate the Git server, capture the SSH deploy key, or inject malicious repository content into DAG bundles. Deployments using the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The weakness is classified under [CWE-322: Key Exchange without Entity Authentication].

Critical Impact
Attackers with network positioning can steal SSH deploy keys and inject malicious DAG code, leading to arbitrary code execution across Airflow workers.

Affected Products

Apache apache-airflow-providers-git versions prior to 0.4.1
Airflow deployments using the Git DAG bundle over SSH
Airflow deployments using the Git provider with SSH deploy keys

Discovery Timeline

2026-07-13 - CVE-2026-58065 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58065

Vulnerability Analysis

The Apache Airflow Git provider clones and syncs DAG repositories over SSH to distribute workflow definitions to workers and schedulers. Prior to version 0.4.1, the provider invoked git with StrictHostKeyChecking=no, instructing OpenSSH to skip verification of the remote host's public key fingerprint. This behavior bypasses the fundamental trust anchor of the SSH protocol.

Without host-key validation, the SSH client accepts any key presented by the remote endpoint. An attacker able to redirect or intercept traffic between the Airflow worker and the legitimate Git server (via ARP spoofing, DNS poisoning, BGP hijacking, or a compromised network device) can present their own SSH host key. The client will proceed with authentication, transmitting the deploy key credential to the attacker-controlled endpoint.

Once the attacker holds the deploy key or controls the repository content served to the worker, they can push malicious DAG files. Airflow executes DAG Python code during parsing, resulting in arbitrary code execution on scheduler and worker nodes.

Root Cause

The root cause is an insecure default configuration. The provider explicitly passed StrictHostKeyChecking=no to git's SSH transport to reduce operational friction during initial setup. This choice removed the entity authentication step required by SSH, satisfying the conditions described in [CWE-322].

Attack Vector

Exploitation requires a network-adjacent adversary capable of intercepting the SSH session between the Airflow worker and the Git server. High attack complexity reflects the need for MITM positioning. Successful exploitation yields deploy key capture, repository content substitution, and downstream code execution when Airflow parses tampered DAG files.

No public proof-of-concept has been published. Technical discussion is available in the Apache Airflow pull request and the Apache mailing list thread.

Detection Methods for CVE-2026-58065

Indicators of Compromise

Unexpected SSH host-key changes in Airflow worker logs when connecting to the Git server
DAG files appearing in the bundle that were not committed by authorized developers
Git commits in the DAG repository originating from unknown SSH keys or unexpected source IPs
Airflow task executions spawning unusual outbound connections or shell processes

Detection Strategies

Audit installed provider versions across Airflow deployments and flag apache-airflow-providers-git releases earlier than 0.4.1
Inspect Airflow configuration and provider source for the presence of StrictHostKeyChecking=no in SSH command construction
Compare git commit hashes fetched by workers against the authoritative Git server to detect content substitution
Monitor network paths between Airflow workers and Git infrastructure for ARP, DNS, or routing anomalies

Monitoring Recommendations

Enable SSH client verbose logging on Airflow workers to record host-key fingerprints presented at connection time
Forward Airflow scheduler, worker, and DAG parsing logs to a centralized SIEM for correlation with network telemetry
Alert on new or modified DAG files that do not match the signed commits from the upstream repository
Track process execution on worker nodes for child processes spawned by DAG parsing that access credentials or network resources

How to Mitigate CVE-2026-58065

Immediate Actions Required

Upgrade apache-airflow-providers-git to version 0.4.1 or later on all Airflow components
Rotate any SSH deploy keys used by the Git provider, since prior connections may have exposed them
Provision a known_hosts file containing the verified public host keys of the Git server and distribute it to all workers
Review recent DAG repository commits for unauthorized changes and revert if tampering is suspected

Patch Information

The fix ships in apache-airflow-providers-git0.4.1, which changes the default behavior to verify host keys. Administrators must also configure a known_hosts file containing the Git server's public keys for verification to succeed. Refer to the GitHub pull request for implementation detail and the Openwall OSS Security post for the coordinated disclosure notice.

Workarounds

If upgrading is not immediately feasible, restrict network paths between Airflow workers and the Git server using dedicated VLANs, VPN tunnels, or private network peering
Replace SSH-based cloning with HTTPS plus a token stored in Airflow connections, ensuring TLS certificate validation is enforced
Deploy a pre-populated known_hosts file and override the provider configuration to reference it, removing reliance on the insecure default

bash

# Configuration example: upgrade the provider and pin known_hosts
pip install --upgrade 'apache-airflow-providers-git>=0.4.1'

# Populate known_hosts with the Git server public key
ssh-keyscan -t rsa,ecdsa,ed25519 git.example.com >> ~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts

# Reference the file in the Airflow Git connection extras
# {"key_file": "/opt/airflow/keys/deploy_key", "known_hosts": "/home/airflow/.ssh/known_hosts"}