SQL Injection

Overview apache-airflow-providers-teradata is a Provider package apache-airflow-providers-teradata for Apache Airflow Affected versions of this package are vulnerable to SQL Injection in the Teradata compute-cluster example DAG, where user-settable Params are not properly constrained, allowing an...

PYSEC-2026-4188

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

PYSEC-2026-4187

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

PYSEC-2026-4187

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-86843

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is permitted to trigger that Dag - a...

PYSEC-2026-4188

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

flytekitplugins-airflow (>=1.14.4, <=1.16.31) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (12.0.0rc2)

apache-airflow-providers-google PYPI version 12.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - flytekitplugins-airflow =1.14.4, =1.16.31 Source cves: CVE-2026-81914 Source advisory:...

airflow-tools (>=0.9.0, <=0.11.0), risk-custom-secrets-provider (>=1.0.9, <=1.1.3) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (10.23.0)

apache-airflow-providers-google PYPI version 10.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-tools =0.9.0, =1.0.9, =1.1.3 Source cves: CVE-2026-81914 Source advisory:...

dagtool (>=0.0.2, <=0.0.7) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (10.21.1)

apache-airflow-providers-google PYPI version 10.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.2, =0.0.7 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-4187...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (7.0.0)

apache-airflow-providers-google PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-418...

gps-building-blocks (1.2.2) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (1.0.0)

apache-airflow-providers-google PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - gps-building-blocks 1.2.2 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-4187...

dataflow-airflow (2.10.10) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (19.0.0)

apache-airflow-providers-google PYPI version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-4187...

dagtool (>=0.0.8, <=0.0.11) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (15.1.0)

apache-airflow-providers-google PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.8, =0.0.11 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-4187...

airflow-parse-bench (>=0.0.1, <=1.0.1), airflow-toolkit (0.13.3) +2 more potentially affected by CVE-2026-81914 via apache-airflow-providers-google (10.26.0)

apache-airflow-providers-google PYPI version 10.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-parse-bench =0.0.1, =0.11.1, =0.1.0, =0.1.1 Source cves: CVE-2026-81914 Source advisory:...

airflow-provider-appops (>=0.0.3, <=0.0.4), astronomer-providers (1.0.0) +1 more potentially affected by CVE-2026-81914 via apache-airflow-providers-google (6.8.0)

apache-airflow-providers-google PYPI version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-provider-appops =0.0.3, =0.0.4, =0.1.4 Source cves: CVE-2026-81914 Source advisory:...

example-pkg-naturalett (>=14.4.4, <=14.4.8) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (4.0.0)

apache-airflow-providers-google PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - example-pkg-naturalett =14.4.4, =14.4.8 Source cves: CVE-2026-81914 Source advisory:...

CVE-2026-81862

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

airflow-oracle-snowflake-plugin (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-81930 via apache-airflow-providers-snowflake (3.3.0)

apache-airflow-providers-snowflake PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-snowflake and may be impacted: - airflow-oracle-snowflake-plugin =0.1.0, =0.1.2 Source cves: CVE-2026-81930 Source advisory:...

CVE-2026-81930

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...