PyPI/apache-airflow-providers-google CVE-2026-45361: high 8.1, EPSS 0.80%

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default

Action: Upgrade apache-airflow-providers-google to 22.0.0 or later.

pip install apache-airflow-providers-google==22.0.0

Affected

Fixed versions

Sources

• osv: GHSA-g9v5-gjwf-9rwx
• https://nvd.nist.gov/vuln/detail/CVE-2026-45361
• https://github.com/apache/airflow/pull/66746
• https://github.com/apache/airflow/commit/120dbed3462cedcb980aac022c587ba434249eb1
• https://github.com/apache/airflow
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-google/PYSEC-2026-166.yaml
• https://lists.apache.org/thread/3lpj7ppwxp7jtp81rnxk75xvln7qd7h2
• http://www.openwall.com/lists/oss-security/2026/05/24/9

CVE-2026-45361 · published 2026-05-26T13:30:40Z · modified 2026-06-30T17:11:25.019772022Z · JSON