apache · shivaam · Jul 10, 2026
diff --git a/providers/sftp/README.rst b/providers/sftp/README.rst
@@ -57,7 +57,7 @@ PIP package                                 Version required
 ``apache-airflow``                          ``>=2.11.0``
 ``apache-airflow-providers-ssh``            ``>=4.0.0``
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
-``paramiko``                                ``>=4.0.0,<5.0.0``
+``paramiko``                                ``>=4.0.0``
 ``asyncssh``                                ``>=2.12.0; python_version < "3.14"``
 ``asyncssh``                                ``>=2.22.0; python_version >= "3.14"``
 ==========================================  ======================================

diff --git a/providers/sftp/docs/changelog.rst b/providers/sftp/docs/changelog.rst
@@ -30,6 +30,13 @@ Changelog
 Breaking changes
 ~~~~~~~~~~~~~~~~
 
+* ``Allow Paramiko 5; legacy SHA-1 SSH algorithms are no longer supported``
+
+  Paramiko 5.0 removed support for RSA SHA-1 ``ssh-rsa`` signatures, SHA-1 key exchange
+  algorithms, and ``GSSAPI``. RSA keys are still supported, but servers must support modern
+  RSA SHA-2 algorithms such as ``rsa-sha2-256`` or ``rsa-sha2-512``. If your SFTP server only
+  supports legacy SHA-1 SSH algorithms, pin ``paramiko<5`` until the server is upgraded.
+
 * ``Bump minimum paramiko to 4.0.0; DSA/DSS keys are no longer supported (#54079)``
 
   This provider depends on paramiko 4.0+, which dropped ``DSS``/``DSA`` keys; see `paramiko changelog <https://www.paramiko.org/changelog.html>`__. To migrate: create a key pair that does not use ``DSA`` (Ed25519 or RSA are typical, e.g. ``ssh-keygen -t ed25519``), add the public key to the SFTP server, then update your Airflow SFTP (or shared SSH) connection so ``key_file`` or the ``private_key`` extra uses the new key, and ensure any ``host_key`` extra is not in ``ssh-dss`` form. If you are not ready to migrate keys, stay on a provider release that still pins ``paramiko<4`` until you can switch.

diff --git a/providers/sftp/docs/index.rst b/providers/sftp/docs/index.rst
@@ -104,7 +104,7 @@ PIP package                                 Version required
 ``apache-airflow``                          ``>=2.11.0``
 ``apache-airflow-providers-ssh``            ``>=4.0.0``
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
-``paramiko``                                ``>=4.0.0,<5.0.0``
+``paramiko``                                ``>=4.0.0``
 ``asyncssh``                                ``>=2.12.0; python_version < "3.14"``
 ``asyncssh``                                ``>=2.22.0; python_version >= "3.14"``
 ==========================================  ======================================

diff --git a/providers/sftp/pyproject.toml b/providers/sftp/pyproject.toml
@@ -63,7 +63,7 @@ dependencies = [
     "apache-airflow>=2.11.0",
     "apache-airflow-providers-ssh>=4.0.0",  # use next version
     "apache-airflow-providers-common-compat>=1.12.0",
-    "paramiko>=4.0.0,<5.0.0",
+    "paramiko>=4.0.0",
     "asyncssh>=2.12.0; python_version < '3.14'",
     "asyncssh>=2.22.0; python_version >= '3.14'",
 ]

diff --git a/providers/ssh/README.rst b/providers/ssh/README.rst
@@ -56,7 +56,7 @@ PIP package                                 Version required
 ``apache-airflow``                          ``>=2.11.0``
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``asyncssh``                                ``>=2.12.0``
-``paramiko``                                ``>=4.0.0,<5.0.0``
+``paramiko``                                ``>=4.0.0``
 ==========================================  ==================
 
 The changelog for the provider package can be found in the

diff --git a/providers/ssh/docs/changelog.rst b/providers/ssh/docs/changelog.rst
@@ -30,6 +30,13 @@ Changelog
 Breaking changes
 ~~~~~~~~~~~~~~~~
 
+* ``Allow Paramiko 5; legacy SHA-1 SSH algorithms are no longer supported``
+
+  Paramiko 5.0 removed support for RSA SHA-1 ``ssh-rsa`` signatures, SHA-1 key exchange
+  algorithms, and ``GSSAPI``. RSA keys are still supported, but servers must support modern
+  RSA SHA-2 algorithms such as ``rsa-sha2-256`` or ``rsa-sha2-512``. If your SSH server only
+  supports legacy SHA-1 SSH algorithms, pin ``paramiko<5`` until the server is upgraded.
+
 * ``Bump minimum paramiko to 4.0.0; DSA/DSS private keys and ssh-dss host keys are no longer supported (#54079)``
 
   Paramiko 4.0 removed DSS/DSA support; see `paramiko changelog <https://www.paramiko.org/changelog.html>`__ for upstream details. If you use a DSA private key in an SSH connection, generate a new key (for example ``ssh-keygen -t ed25519`` or ``-t rsa``), install the public key on the server, and point your Airflow connection at the new key file or ``private_key`` extra. If you pin the remote host with a ``host_key`` extra in ``ssh-dss`` form, obtain the server's current RSA, ECDSA, or Ed25519 host key and replace the value. The same constraints apply to SFTP connections that rely on paramiko via the SSH provider.

diff --git a/providers/ssh/docs/index.rst b/providers/ssh/docs/index.rst
@@ -95,7 +95,7 @@ PIP package                                 Version required
 ``apache-airflow``                          ``>=2.11.0``
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``asyncssh``                                ``>=2.12.0``
-``paramiko``                                ``>=4.0.0,<5.0.0``
+``paramiko``                                ``>=4.0.0``
 ==========================================  ==================
 
 Downloading official packages

diff --git a/providers/ssh/pyproject.toml b/providers/ssh/pyproject.toml
@@ -62,7 +62,7 @@ dependencies = [
     "apache-airflow>=2.11.0",
     "apache-airflow-providers-common-compat>=1.12.0",
     "asyncssh>=2.12.0",
-    "paramiko>=4.0.0,<5.0.0",
+    "paramiko>=4.0.0",
 
 ]
 

diff --git a/providers/ssh/src/airflow/providers/ssh/hooks/ssh.py b/providers/ssh/src/airflow/providers/ssh/hooks/ssh.py
@@ -444,7 +444,10 @@ def _pkey_from_private_key(self, private_key: str, passphrase: str | None = None
                 key = pkey_class.from_private_key(StringIO(private_key), password=passphrase)
                 # Test it actually works. If Paramiko loads an openssh generated key, sometimes it will
                 # happily load it as the wrong type, only to fail when actually used.
-                key.sign_ssh_data(b"")
+                if key.get_name() == "ssh-rsa":
+                    key.sign_ssh_data(b"", algorithm="rsa-sha2-512")
+                else:
+                    key.sign_ssh_data(b"")
                 return key
             except (paramiko.ssh_exception.SSHException, ValueError):
                 continue