{"schema":"threatline.record/2","record":{"id":"CVE-2026-81914","aliases":[],"summary":"Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names","details":"Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.","categories":["Unclassified"],"product":"Apache Airflow Google provider","vendor":"Apache Software Foundation","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81914","source_modified_at":"2026-09-29T20:03:23.525Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Apache Airflow Google provider","vendor":"Apache Software Foundation","versions":[{"lessThan":"22.6.0","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-81914","source_modified_at":"2026-09-29T20:03:23.525Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"Apache Airflow Google provider","ecosystem":null},"version":"22.6.0","basis":"first unaffected version stated in the CVE record"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00509,"percentile":0.42608,"score_date":"2026-10-23"},"published_at":"2026-09-29T09:58:12.848Z","modified_at":"2026-09-29T20:03:23.525Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-81914","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-29T20:03:23.525Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-81914","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/apache/airflow/pull/72166","tags":["patch"]},{"source":"CVE List","url":"https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-29T20:02:49.245279Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-29T20:03:23.525Z","content_hash":"8beacc6b8ff53077998634853b23cb60102f29e2234594abc0d42a1e5141c732"}}