En bref
- CVE-2026-45361 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant apache-airflow-providers-google, apache-airflow-providers-google (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.59%, plus élevée que 48.2% des vulnérabilités.
- Correctif : mettre à jour vers 22.0.0 ou plus récent.
Description
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
NVD description
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
Autres vulnérabilités de apache-airflow-providers-google
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free