Improper Neutralization of Special Elements in Data Query Logic

Overview apache-airflow-providers-google is a Provider for Apache Airflow. Implements apache-airflow-providers-google package Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via GoogleDriveHook in drive.py, where folder names, fi...

Insufficient Granularity of Access Control

Overview apache-airflow-providers-google is a Provider for Apache Airflow. Implements apache-airflow-providers-google package Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the google Secret Manager backend process. An attacker can access other...

flytekitplugins-airflow (>=1.14.4, <=1.16.29) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (12.0.0rc2)

apache-airflow-providers-google PYPI version 12.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - flytekitplugins-airflow =1.14.4, =1.16.29 Source cves: CVE-2026-68868 Source advisory:...

gps-building-blocks (1.2.2) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (1.0.0)

apache-airflow-providers-google PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - gps-building-blocks 1.2.2 Source cves: CVE-2026-68868 Source advisory: OSV:PYSEC-2026-3714...

example-pkg-naturalett (>=14.4.4, <=14.4.8) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (4.0.0)

apache-airflow-providers-google PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - example-pkg-naturalett =14.4.4, =14.4.8 Source cves: CVE-2026-68868 Source advisory:...

dagtool (>=0.0.8, <=0.0.11) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (15.1.0)

apache-airflow-providers-google PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.8, =0.0.11 Source cves: CVE-2026-68868 Source advisory: OSV:PYSEC-2026-3714...

airflow-provider-appops (>=0.0.3, <=0.0.4), astronomer-providers (1.0.0) +1 more potentially affected by CVE-2026-68868 via apache-airflow-providers-google (6.8.0)

apache-airflow-providers-google PYPI version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-provider-appops =0.0.3, =0.0.4, =0.1.4 Source cves: CVE-2026-68868 Source advisory:...

PT-2026-71048

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's team name was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnost...

CVE-2026-49297: Improper Limitation of a Pathname to a Restricted Directory

Apache Airflow's Google provider operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket...

ROOT-APP-PYPI-CVE-2023-25692 CVE-2023-25692 in rootio-apache-airflow-providers-google - Patched by Root

Root has patched CVE-2023-25692 in the rootio-apache-airflow-providers-google package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-25691 CVE-2023-25691 in rootio-apache-airflow-providers-google - Patched by Root

Root has patched CVE-2023-25691 in the rootio-apache-airflow-providers-google package for Root:PyPI. Multiple fixed versions available...

airflow-provider-appops (>=0.0.3, <=0.0.4), astronomer-providers (1.0.0) +1 more potentially affected by CVE-2026-45361 via apache-airflow-providers-google (6.8.0)

apache-airflow-providers-google PYPI version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-provider-appops =0.0.3, =0.0.4, =0.1.4 Source cves: CVE-2026-45361 Source advisory:...

flytekitplugins-airflow (>=1.14.4, <=1.16.29) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (12.0.0rc2)

apache-airflow-providers-google PYPI version 12.0.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - flytekitplugins-airflow =1.14.4, =1.16.29 Source cves: CVE-2026-45361 Source advisory:...

dagtool (>=0.0.2, <=0.0.7) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (10.21.1)

apache-airflow-providers-google PYPI version 10.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.2, =0.0.7 Source cves: CVE-2026-45361 Source advisory: OSV:GHSA-G9V5-GJWF-9RWX...

dataflow-airflow (2.10.10) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (19.0.0)

apache-airflow-providers-google PYPI version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2026-45361 Source advisory: OSV:GHSA-G9V5-GJWF-9RWX...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2), airflow-parse-bench (>=0.0.1, <=1.0.1) +12 more potentially affected by CVE-2026-45361 via apache-airflow-providers-google (>=1.0.0, <=19.0.0)

apache-airflow-providers-google PYPI version =1.0.0, =0.2.9b1, =0.0.1, =0.0.3, =0.9.0, =0.1.0, =0.0.2, =0.0.4, =14.4.4, =1.14.4, =1.0.9, =1.1.3 Source cves: CVE-2026-45361 Source advisory: GHSA-G9V5-GJWF-9RWX...

dagtool (>=0.0.2, <=0.0.7) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (10.21.1)

apache-airflow-providers-google PYPI version 10.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.2, =0.0.7 Source cves: CVE-2026-45361 Source advisory: OSV:PYSEC-2026-166...

dataflow-airflow (2.10.10) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (19.0.0)

apache-airflow-providers-google PYPI version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2026-45361 Source advisory: OSV:PYSEC-2026-166...

airflow-tools (>=0.9.0, <=0.11.0), risk-custom-secrets-provider (>=1.0.9, <=1.1.3) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (10.23.0)

apache-airflow-providers-google PYPI version 10.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-tools =0.9.0, =1.0.9, =1.1.3 Source cves: CVE-2026-45361 Source advisory:...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-45361 via apache-airflow-providers-google (7.0.0)

apache-airflow-providers-google PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-45361 Source advisory: OSV:PYSEC-2026-166...