Airflow Google provider: GCS object names with .. segments write outside the destination path

Impact

Both operators join GCS object names returned by the bucket listing API directly onto a destination path with no normalisation or containment check. Someone who can write to the source bucket - a partner upload, an ingest-only service account, a public dataset bucket, typically a different trust principal from the DAG author - can name an object with .. segments and have the DAG run write the blob outside the intended destination: anywhere on the SFTP server for GCSToSFTPOperator, anywhere the worker process can write for GCSTimeSpanFileTransformOperator. On a shared Airflow installation driving dataset ingestion for a GPU fleet, that is arbitrary file overwrite on the worker host, which includes the files Airflow itself executes, so it escalates to code execution in the pipeline's context. Only deployments that ingest from buckets writable by less-trusted principals are affected. Fixed in apache-airflow-providers-google 22.2.1.

Who can reach it

Anyone with write access to a source GCS bucket that an affected DAG lists; no Airflow account is needed. Exploitation happens when the scheduled DAG next runs.

What to do

Upgrade apache-airflow-providers-google to 22.2.1 or later and restart the schedulers and workers - a daemon restart, no node drain. Until then, review which source buckets are writable by principals outside your trust boundary, and inspect the destination paths and the worker temp directories on hosts that ran these operators against such buckets.

References

Related entries

• OpenStack glance_store: VMware datastore driver sends authentication headers to an attacker-supplied image location hostCVE-2026-51773 · OpenStack glance_store (VMware datastore driver, _retry_request)High
• Ceph RGW: unsigned x-amz-* headers on presigned URLs are honored, letting a URL holder escalate privilegesCVE-2026-54330 · Ceph Object Gateway (RGW SigV4 presigned-URL header validation)High
• Apache Airflow Git provider: SSH host-key verification disabled by default when cloning DAG bundlesCVE-2026-58065 · Apache Airflow Git provider (apache-airflow-providers-git, git-over-SSH host key checking)High
• Apache Airflow FAB provider: a DAG named 'DAGs' collides with the global all-DAGs permission and escalates privilegesCVE-2026-59245 · Apache Airflow FAB auth manager (apache-airflow-providers-fab, resource_name collision)High
• Linux MACsec (replay protection at XPN lower-PN wrap): MACsec replay protection fails at the extended-packet-numberCVE-2026-63925 · Linux MACsec (replay protection at XPN lower-PN wrap)High
• Atlantis: workspace names escape the working directory into os.RemoveAll and os.MkdirAllCVE-2026-64679 · Atlantis (workspace path handling in atlantis.yaml and /api/plan)High