Apache Software Foundation Apache Airflow Google Provider

• CVE-2026-81914 Medium 4.3 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names 0.5%
• CVE-2026-68868 Medium 6.5 Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables 0.6%
• CVE-2026-49297 High 8.1 Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) 1.0%
• CVE-2026-45361 High 8.1 Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) 0.6%
• CVE-2023-25692 High 7.5 Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service 1.8%
• CVE-2023-25691 Critical 9.8 Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution 1.6%