CVE-2026-58065: Key Exchange without Entity Authentication

The Apache Airflow Git provider runs its git-over-SSH operations with StrictHostKeyChecking=no by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server man-in-the-middle, capturing the S...

PT-2026-51270

Name of the Vulnerable Software and Affected Versions centraldogma-server-mirror-git versions prior to 0.84.0 Description The Git mirror SSH client fails to verify remote host keys for git+ssh:// connections. This allows an on-path attacker to conduct man-in-the-middle attacks, which can lead to...