Apache Apache-airflow-providers-google — known CVE vulnerabilities

Every CVE whose affected-product data names Apache Apache-airflow-providers-google, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2023-25691 — CVSS 9.8 (critical): Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions…
• CVE-2026-45361 — CVSS 8.1 (high): Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an…
• CVE-2026-49297 — CVSS 8.1 (high): Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by…
• CVE-2023-25692 — CVSS 7.5 (high): Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions…
• CVE-2026-68868 — CVSS 6.5 (medium): The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections…