CVE-2026-58065: CWE-322: Key Exchange without Entity Authentication in Apache Software Foundation Apache Airflow Git provider

The Apache Airflow Git provider runs git-over-SSH operations with StrictHostKeyChecking=no by default, disabling SSH host-key verification. This configuration flaw enables an attacker who can intercept the network path between an Airflow worker and the Git server to perform a man-in-the-middle attack, impersonate the server, capture SSH deploy keys, or inject malicious repository content. The vulnerability affects versions prior to 0.4.1. The fix involves upgrading to apache-airflow-providers-git version 0.4.1 or later and configuring a known_hosts file to enforce host key verification.

An attacker capable of intercepting network traffic between an Airflow worker and the Git server can impersonate the Git server, leading to compromise of SSH deploy keys and injection of malicious code into repositories. This can result in unauthorized code execution, data compromise, and disruption of deployment workflows. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability.

Upgrade apache-airflow-providers-git to version 0.4.1 or later, which changes the default behavior to verify SSH host keys. Additionally, configure a known_hosts file to enable proper host key verification during git-over-SSH operations. No other vendor advisory or patch information is provided; patch status is confirmed by the version upgrade recommendation.