apache-airflow-providers-google vulnerabilities (PyPI)

6 vulnerabilities.

• apache-airflow-providers-google PyPI Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names CVE-2026-81914 Fix available 4.3 MediumSeptember 29, 2026
• apache-airflow-providers-google PyPI Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables CVE-2026-68868 Fix available 6.5 MediumAugust 12, 2026
• apache-airflow-providers-google PyPI Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) CVE-2026-49297 Fix available 8.1 HighJuly 6, 2026
• apache-airflow-providers-google PyPI Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) CVE-2026-45361 Fix available 8.1 HighMay 25, 2026
• apache-airflow-providers-google PyPI Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service CVE-2023-25692 Fix available 7.5 HighFebruary 24, 2023
• apache-airflow-providers-google PyPI Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution CVE-2023-25691 Fix available 9.8 CriticalFebruary 24, 2023