Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-81914

CVE-2026-81914MEDIUM

Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  N  N    4.3   .0029   19.4     —

AFFECTED
  Product                         Versions     Fixed
  Apache Airflow Google provider  unspecified  —

TIMELINE
  Aug 27  Reserved by apache
  Sep 29  Published (CNA: apache)
  Oct 7   EXPLOIT PUBLISHED — CVE-2026-81914 (Apache Software Foundation Apache Airflow Google provider). Public exploit reference added.

CWE-943 · CNA: apache · CVSS v3.1 · 3 references · NVD status: Analyzed

Description

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query. The names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for. Affects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 27, 2026	Reserved	Reserved by apache
September 29, 2026	Published	Published (CNA: apache)
October 7, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-81914 (Apache Software Foundation Apache Airflow Google provider). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Apache Software Foundation	Apache Airflow Google provider	—	—	—

Weaknesses

CWE-943

References (3)

http://www.openwall.com/lists/oss-security/2026/09/29/13 [Mailing List, Third Party Advisory]
https://github.com/apache/airflow/pull/72166 [Exploit, Patch]
https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo [Mailing List, Vendor Advisory]

Authoritative record: CVE-2026-81914 at cve.org

Vendors: apache

Weaknesses: CWE-943

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-81914 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.