Apache Airflow Google provider vulnerabilities | LiveThreat CVE Feed

Product

Apache Airflow Google provider

by Apache Software Foundation · last CVE Sep 29, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Severity mix

Critical 0High 2Medium 2Low 0

Severity

Exploitation

Watch

Add Apache Airflow Google provider to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-49297	8.1	1%	Jul 6	Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator) Affected: before 22.2.1
CVE-2026-45361	8.1	1%	May 25	Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default) Affected: before 22.0.0