Apache Apache-Airflow-Providers-Google vulnerabilities

6 CVEs affecting Apache Apache-Airflow-Providers-Google, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-81914, published 2026-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-25692, published 2023-02-24. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
CVE-2023-25691, published 2023-02-24. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
CVE-2026-49297, published 2026-07-06. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem…
CVE-2026-45361, published 2026-05-25. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network…
CVE-2026-68868, published 2026-08-12. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the…
CVE-2026-81914, published 2026-09-29. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that…