CVE-2026-94134: Apache Airflow SSH and SFTP providers disable SSH host-key verification by default, accepting any server key unless configured otherwise. A machine-in-the-middle attacker can impersonate the server and capture the credentials or data a task sends. The Apache Software Foundation fixed both providers in version 7.0.0. No exploitation is confirmed. https://www.cve.org/CVERecord?id=CVE-2026-94134 #infosec #cybersecurity