What’s Vulnerable › Products

Apache Software Foundation Apache Airflow Google provider vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your Apache Software Foundation Apache Airflow Google provider version is affected

Latest Apache Software Foundation Apache Airflow Google provider vulnerabilities

• CVE-2026-81914 — Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names (CVSS 4.3)
• CVE-2026-68868 — Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables (CVSS 6.5)
• CVE-2026-49297 — Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) (CVSS 8.1)
• CVE-2026-45361 — Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) (CVSS 8.1)
• CVE-2023-25692 — Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service (CVSS 7.5)
• CVE-2023-25691 — Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution (CVSS 9.8)