Airflow Git Provider CVE-2026-58065

Exploitation requires the deployment to use the Git provider or Git DAG bundle to clone over SSH with a deploy key AND to rely on the vulnerable default strict_host_key_checking='no' (no known_hosts pinning). The attacker must hold an active man-in-the-middle position on the network path between the Airflow worker and the Git server - this is the primary limiting factor (reflected as AC:H) and is not satisfied over an authenticated or verified TLS/SSH channel. Deployments cloning over HTTPS, or that have already set strict_host_key_checking to 'yes'/'accept-new' with a configured known_hosts_file, are not exposed. No local access, credentials, or user interaction is required (PR:N/UI:N), but the on-path prerequisite meaningfully narrows realistic exploitation to shared, untrusted, or compromised network segments.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1) shows unauthenticated, no-user-interaction, network-reachable exploitation with full confidentiality/integrity/availability impact, but the High attack complexity is the key limiter: the attacker must already hold a privileged network position to intercept and actively MITM the worker-to-Git SSH channel, which is not trivial in well-segmented environments. There is no EPSS score provided and no KEV listing, so no independent signal of active or automated exploitation; POC availability is not indicated. This is a genuine and correctly-rated design weakness rather than an inflated score, but real-world priority is moderated by the on-path prerequisite - it is most acute where Airflow workers reach a Git server over untrusted or shared network segments. Note the input provides no EPSS/SSVC data, so automatability and exploitation-status framework signals are unknown and cannot be weighed.

An attacker who can occupy a network position between an Airflow worker and its Git server (e.g., a rogue device on a shared subnet or a compromised upstream hop) responds to the worker's SSH clone with their own host key, which is accepted because verification is disabled. The attacker captures the SSH deploy key and serves malicious repository content, causing Airflow to load and execute attacker-controlled DAG code on the worker. No POC is indicated in the available data, and the high-complexity on-path requirement makes this an opportunistic-position rather than trivial remote attack.