PatchTheCVECVE-2026-81914: Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names
CVE-2026-81914 is a medium-severity flaw (CVSS 4.3) affecting apache-airflow-providers-google. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query. The names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come
Why this priority
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 60%) |
| CISA exploited list | No |
| Weakness | CWE-943 |
| Published | 2026-09-29 |
| Last modified | 2026-10-07 |
Last updated 2026-10-07 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-81914?
apache-airflow-providers-google: upgrade to 22.6.0. Exact commands for each OS are on this page.
Is CVE-2026-81914 being exploited?
CVE-2026-81914 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-81914 affect?
CVE-2026-81914 affects apache-airflow-providers-google. Severity is medium (CVSS 4.3). Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostro
How urgent is CVE-2026-81914?
Priority 35/100. Public exploit reference; On your watchlist
Software pages
Apache Airflow vulnerabilities
Related CVEs
- CVE-2026-49297 HIGH 8.1 UPGRADE Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined G
- CVE-2026-68868 MEDIUM 6.5 UPGRADE The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team sco