Answer in brief
CVE-2026-58065 records a High severity (CVSS 8.1) vulnerability in Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification. The current sources do not mark it as known exploited. The current feed maps Apache Software Foundation/Apache Airflow Git provider (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Apache Software Foundation/Apache Airflow Git provider (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Apache Software Foundation/Apache Airflow Git providergeneric | >=0 <0.4.1 | 0.4.1 |
Published upstream
Jul 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 13, 2026
The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.
Quoted source text, attributed separately from HOL analysis.