{"id":"CVE-2026-81914","aliases":["EUVD-2026-88694","GHSA-g995-5p95-2fw6","PYSEC-2026-4187"],"status":"published","title":"Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0047,"percentile":0.41185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-943"],"published":"2026-09-29T09:58:12Z","modified":"2026-10-28T02:59:00Z","fixes":[{"ecosystem":"PyPI","package":"apache-airflow-providers-google","fixed_in":["22.6.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"PyPI","package":"apache-airflow-providers-google","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.6.0"}]}],"versions":["1.0.0","1.0.0b1","1.0.0b2","1.0.0rc1","10.0.0","10.0.0rc1","10.1.0","10.1.0rc1","10.1.0rc2","10.1.1","10.1.1rc1","10.10.0","10.10.0rc1","10.10.1","10.10.1rc1","10.11.0","10.11.0rc1","10.11.1","10.11.1rc1","10.12.0","10.12.0rc1","10.13.0","10.13.0rc1","10.13.0rc2","10.13.0rc3","10.13.1","10.13.1rc1","10.14.0","10.14.0rc1","10.14.0rc2","10.15.0","10.15.0rc1","10.16.0","10.16.0rc1","10.17.0","10.17.0rc1","10.18.0","10.18.0rc1","10.18.0rc2","10.19.0","10.19.0rc1","10.2.0","10.2.0rc1","10.20.0","10.20.0rc1","10.21.0","10.21.0rc1","10.21.1","10.21.1rc1","10.21.1rc2","10.22.0","10.22.0rc1","10.23.0","10.23.0rc1","10.24.0","10.24.0rc1","10.25.0","10.25.0rc1","10.26.0","10.26.0rc1","10.3.0","10.3.0rc1","10.3.0rc2","10.4.0","10.4.0rc1","10.5.0","10.5.0rc1","10.6.0","10.6.0rc1","10.6.0rc2","10.6.0rc3","10.7.0","10.7.0rc1","10.8.0","10.8.0rc1","10.9.0","10.9.0rc1","11.0.0","11.0.0rc1","12.0.0","12.0.0rc1","12.0.0rc2","13.0.0","14.0.0","14.0.0rc1","14.1.0","14.1.0rc1","15.0.0","15.0.0rc1","15.0.1","15.0.1rc1","15.1.0","15.1.0rc1","16.0.0","16.0.0rc1","16.1.0","16.1.0rc1","17.0.0","17.0.0rc1","17.1.0","17.1.0rc1","17.2.0","17.2.0rc1","18.0.0","18.0.0rc1","18.1.0","18.1.0rc1","19.0.0","19.0.0rc1","19.1.0","19.1.0rc1","19.1.0rc2","19.2.0","19.2.0rc1","19.3.0","19.3.0rc1","19.4.0","19.4.0rc1","19.4.0rc2","19.5.0","19.5.0rc1","2.0.0","2.0.0rc1","2.1.0","2.1.0rc1","2.2.0","2.2.0rc1","20.0.0","20.0.0rc1","20.0.0rc2","21.0.0","21.0.0rc1","21.0.0rc2","21.1.0","21.1.0rc1","21.2.0","21.2.0rc1","21.3.0","21.3.0rc1","22.0.0","22.0.0rc1","22.1.0","22.1.0rc1","22.2.0","22.2.0rc1","22.2.1","22.2.1rc1","22.2.2","22.2.2rc1","22.3.0","22.3.0rc1","22.3.0rc2","22.3.0rc3","22.3.0rc4","22.4.0","22.4.0rc1","22.5.0","22.5.0rc1","22.6.0rc1","3.0.0","3.0.0rc1","4.0.0","4.0.0rc1","4.0.0rc2","4.1.0rc1","5.0.0","5.0.0rc2","5.1.0","5.1.0rc1","6.0.0","6.0.0rc1","6.1.0","6.1.0rc1","6.2.0","6.2.0rc1","6.3.0","6.3.0rc1","6.4.0","6.4.0rc1","6.4.0rc2","6.4.0rc3","6.5.0","6.5.0rc1","6.6.0","6.6.0rc1","6.7.0","6.7.0rc1","6.8.0","6.8.0rc1","7.0.0","7.0.0rc1","8.0.0","8.0.0rc1","8.0.0rc2","8.1.0","8.1.0rc1","8.10.0","8.10.0rc1","8.11.0","8.11.0rc1","8.12.0","8.12.0rc1","8.2.0","8.2.0rc1","8.3.0","8.3.0rc1","8.3.0rc2","8.3.0rc3","8.4.0","8.4.0rc1","8.4.0rc2","8.5.0","8.5.0rc1","8.6.0","8.6.0rc2","8.6.0rc3","8.7.0","8.7.0rc1","8.7.0rc2","8.8.0","8.8.0rc1","8.9.0","8.9.0rc1","9.0.0","9.0.0rc1","9.0.0rc2"]}],"products":[{"vendor":"apache","product":"apache-airflow-providers-google"},{"vendor":"apache software foundation","product":"apache airflow google provider"}],"references":[{"url":"https://github.com/apache/airflow/pull/72166","tags":["patch","Exploit","Patch","fix"]},{"url":"https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/29/13","tags":["Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81914","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g995-5p95-2fw6"},{"url":"https://pypi.python.org","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81914.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-81914","title":"Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","status":"published","published":"2026-09-29T09:58:12.848Z","modified":"2026-09-29T20:03:23.525Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-88694","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","status":"published","published":"2026-09-29T09:58:12Z","modified":"2026-09-29T20:03:23Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:51.078545Z"}],"ghsa":[{"id":"GHSA-g995-5p95-2fw6","title":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and...","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","status":"published","published":"2026-09-29T12:31:29Z","modified":"2026-09-29T21:33:09Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:12:33.840327Z"}],"nvd":[{"id":"CVE-2026-81914","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","status":"published","published":"2026-09-29T10:17:12.53Z","modified":"2026-10-07T19:58:47.973Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:12:52.413234Z"}],"osv":[{"id":"CVE-2026-81914","title":"Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","status":"published","published":"2026-09-29T09:58:12.848Z","modified":"2026-10-28T02:59:00.413074445Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:45:18.131258Z"},{"id":"PYSEC-2026-4187","description":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","status":"published","published":"2026-09-29T10:17:12.53Z","modified":"2026-10-08T10:00:02.913095192Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}