CVE-2026-45361 is a vulnerability in the Apache Airflow Google provider's ComputeEngineSSHHook component. The hook disables SSH host-key verification by default, which constitutes a key exchange without entity authentication (CWE-322). This allows an attacker positioned in the network path to intercept or modify SSH sessions between Airflow workers and Google Compute Engine virtual machines. The vulnerability affects all versions prior to 22.0.0. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

An attacker capable of intercepting network traffic can exploit this vulnerability to perform man-in-the-middle attacks on SSH sessions initiated by Airflow workers to Compute Engine VMs. This can lead to disclosure, modification, or disruption of sensitive operations performed over SSH, severely impacting confidentiality, integrity, and availability of the affected systems.

Users should upgrade to apache-airflow-providers-google version 22.0.0 or later, where SSH host-key verification is enabled by default. No official patch or temporary fix details are provided beyond this upgrade recommendation. Patch status is not yet confirmed by a vendor advisory; users should verify the vendor's official guidance for the latest remediation information.