Apache Airflow Google Provider
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_airflow_google_provider:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Airflow Google Provider (4fb73598-7154-5ae5-bf5a-17a7495c99dc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49297 |
vulnerable | 2026-07-29 00:57:45.357528 |
Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later.
Published: 2026-07-06T09:54:07.148Z
Updated: 2026-07-06T19:26:04.051Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45361 |
vulnerable | 2026-06-08 08:05:11.714490 |
Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to `apache-airflow-providers-google` 22.0.0 or later.
Published: 2026-05-25T09:34:01.126Z
Updated: 2026-06-01T15:48:53.991Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25692 |
vulnerable | 2026-06-08 05:56:09.651694 |
Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
Published: 2023-02-24T11:48:00.202Z
Updated: 2025-03-11T20:36:18.446Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25691 |
vulnerable | 2026-06-08 05:56:09.650669 |
Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
Published: 2023-02-24T11:35:49.091Z
Updated: 2025-03-11T20:44:52.284Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.