Apache-airflow-providers-google (Apache) - vulnerabilities (CVEs)

6 CVEs, 1 in the last 30 days, 155 known versions, newest CVE from 2026-09-29. Vendor: Apache.

CVEs of Apache-airflow-providers-google

• CVE-2026-81914 - CVSS 4.3 (medium), 2026-09-29: Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals,…
• CVE-2026-68868 - CVSS 6.5 (medium), 2026-08-12: The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the…
• CVE-2026-49297 - CVSS 8.1 (high), 2026-07-06: Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing…
• CVE-2026-45361 - CVSS 8.1 (high), 2026-05-25: Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a…
• CVE-2023-25692 - CVSS 7.5 (high), 2023-02-24: Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
• CVE-2023-25691 - CVSS 9.8 (critical), 2023-02-24: Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.