Aller au contenu
en Se connecter
Non notée

CVE-2026-49297 Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS…

Description

Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket (typically a different trust principal than the DAG author — partner uploads, ingest-only service accounts, public-data buckets) could create an object whose name contains `..` segments and cause the DAG run to write the downloaded blob outside the configured destination (the SFTP `destination_path` for `GCSToSFTPOperator`; the worker-local temp directory for `GCSTimeSpanFileTransformOperator`), enabling overwrite of arbitrary files on the SFTP server or the worker host. Affects deployments that ingest from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` 22.2.1 or later.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Airflow Google Provider 22.2 premières → < 22.2.1 22.2.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Airflow Google Provider

Les 6 CVE de Apache Airflow Google Provider →
CVE-2026-81914 Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly… Non notée CVE-2026-68868 The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when… Non notée CVE-2026-45361 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH… Non notée CVE-2023-25692 Improper Input Validation vulnerability in the Apache Airflow Google Provider Non notée
Suivre cette CVE