Vulnerability Details CVE-2026-45361
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 25.2%
CVSS Severity
CVSS v3 Score 8.1
References
Products affected by CVE-2026-45361
-
cpe:2.3:a:apache:apache-airflow-providers-google:1.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:1.3.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.11.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.11.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.12.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.13.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.13.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.14.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.15.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.16.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.17.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.18.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.19.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.20.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.21.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.21.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.22.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.23.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.24.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.25.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:10.26.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:11.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:12.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:14.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:14.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:15.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:15.0.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:15.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:16.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:16.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:17.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:17.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:17.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:18.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:18.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:19.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:2.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:20.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:21.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:3.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:4.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:4.1.1
-
cpe:2.3:a:apache:apache-airflow-providers-google:5.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:5.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:6.8.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:7.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.0.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.1.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.10.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.11.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.12.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.2.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.3.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.4.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.5.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.6.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.7.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.8.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:8.9.0
-
cpe:2.3:a:apache:apache-airflow-providers-google:9.0.0