CVE-2026-81914

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-google versions prior to 22.6.0

Description The Google provider in Apache Airflow constructs Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals without escaping the quote character. This allows a name containing an apostrophe to terminate the literal early, enabling an attacker to append arbitrary clauses to the query. In scenarios such as wildcard gcs to gdrive transfers, these names may originate from source bucket listings controlled by external data producers or ingest-only service accounts. An attacker can use this to manipulate which file or folder the hook resolves, potentially directing uploads to an attacker-controlled folder or causing downloads to retrieve a malicious file instead of the intended one.

Recommendations Upgrade to apache-airflow-providers-google version 22.6.0 or later.