CVE-2026-81914: Apache Airflow Google Provider Vulnerability in Google Drive Query Handling
Summary
CVE-2026-81914: Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. Affects apache-airflow-providers-google versions < 22.6.0. Fixed in 22.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. The Google provider for Apache Airflow allows users to interact with Google services, including Google Drive. This package facilitates data transfers and operations between Airflow and Google Drive, making it essential for workflows that involve cloud storage. However, it has a vulnerability that can be exploited if not properly managed.
Vulnerability Detail
The vulnerability arises from the way Apache Airflow's Google provider constructs Google Drive search expressions. It directly interpolates file and folder names into single-quoted string literals without escaping the quote character. This oversight allows an attacker to inject malicious clauses into the query by using names that contain apostrophes. As a result, an attacker can manipulate the query to broaden the match, potentially directing uploads to unauthorized folders or retrieving files that were not intended by the Dag author. This vulnerability primarily affects deployments that pass externally-sourced names to the Google Drive hook, particularly in wildcard gcs_to_gdrive transfers from less-trusted sources.
How To Fix
Latest published version: 22.7.0 as of 23 Oct 2026
pip install --upgrade "apache-airflow-providers-google==22.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
22.6.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow-providers-google==22.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any file or folder names being passed to the Google Drive hook are sanitized and do not contain apostrophes or other special characters that could lead to injection attacks. However, this is not a complete solution and upgrading the package is strongly recommended.
Conclusion
The vulnerability CVE-2026-81914 in the Apache Airflow Google provider poses a significant risk due to improper handling of file and folder names in Google Drive queries. Users are strongly advised to upgrade to version 22.6.0 or later to mitigate this risk. For those unable to upgrade immediately, sanitizing input names can serve as a temporary measure.
See every vulnerability recorded for apache-airflow-providers-google →
FAQ
CVE-2026-81914 is a vulnerability in the Apache Airflow Google provider that allows for injection attacks through improperly handled file and folder names in Google Drive queries.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
An attacker could manipulate Google Drive queries to upload files to unauthorized locations or retrieve unintended files, compromising the integrity of your workflows.
If an immediate upgrade is not possible, ensure that any names passed to the Google Drive hook are sanitized to avoid special characters that could lead to injection attacks.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow-providers-google.
