Apache Airflow Google Provider ComputeEngineSSHHook SSH Host Key Verification Disabled Vulnerability

A vulnerability exists in the Apache Airflow Google provider's ComputeEngineSSHHook, which disables SSH host-key verification by default. This flaw exposes SSH traffic between an Airflow worker and a Google Compute Engine VM to potential interception or modification by in-path network attackers. The issue affects versions of the Apache Airflow Google provider prior to 22.0.0.

Impact

Exploitation of this vulnerability allows for interception or modification of SSH sessions between Airflow workers and Compute Engine VMs, potentially leading to unauthorized access or manipulation of data.

Remediation

Users are advised to upgrade to apache-airflow-providers-google version 22.0.0 or later.