Skip to contentApache Software Foundation Airflow Google Provider vulnerabilities
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: Google Drive query injection via unescaped file and folder namesCVE-2026-81914Fix available4.3 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and VariablesCVE-2026-68868Fix available6.5 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)CVE-2026-49297Fix available8.1 High
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)CVE-2026-45361Fix available8.1 High
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceCVE-2023-25692Fix available7.5 High
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionCVE-2023-25691Fix available9.8 Critical