CVE-2026-45361

🗓️ 25 May 2026 09:34:01Reported by MendType

mend🔗 www.mend.io👁 4 Views

Insecure SSH host-key verification in providers-google's ComputeEngineSSHHook.

Reporter	Title	Published	Views	Family All 22
attackerkb	CVE-2026-45361	25 May 202609:34	–	attackerkb
Circl	CVE-2026-45361	28 May 202602:07	–	circl
CNNVD	Apache Airflow 安全漏洞	25 May 202600:00	–	cnnvd
CVE	CVE-2026-45361	25 May 202609:34	–	cve
Cvelist	CVE-2026-45361 Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)	25 May 202609:34	–	cvelist
EUVD	EUVD-2026-31659	25 May 202609:34	–	euvd
Github Security Blog	Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default	26 May 202613:30	–	github
NVD	CVE-2026-45361	25 May 202610:16	–	nvd
OSV	CGA-7F4C-PC83-RR3G	1 Jul 202612:10	–	osv
OSV	CGA-9WH3-7FC6-32FG	1 Jul 202614:25	–	osv

Vulners

Node

OR

apache apache-airflow-providers-googleRange2.0.0–22.0.0

apache apache-airflow-providers-googleRange1.0.0b1–22.0.0

Source	Link
github	www.github.com/apache/airflow/pull/66746
lists	www.lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2
github	www.github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-google/PYSEC-2026-166.yaml
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45361.json
github	www.github.com/apache/airflow
lists	www.lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45361
github	www.github.com/apache/airflow/commit/120dbed3462cedcb980aac022c587ba434249eb1
pypi	www.pypi.python.org/
openwall	www.openwall.com/lists/oss-security/2026/05/24/9

07 Oct 2026 22:48Current

CVSS 3.18.1

CVSS 49.2

EPSS0.00803

SSVC

providers-google ComputeEngineSSHHook SSH host-key verification in-path network attackers