PyPI/apache-airflow-providers-google CVE-2026-49297: high 8.1, EPSS 0.99%

Apache Airflow Google provider allows path traversal through GCS object names

Action: Upgrade apache-airflow-providers-google to 22.2.1 or later.

pip install apache-airflow-providers-google==22.2.1

Affected

Fixed versions

Sources

• osv: GHSA-v3mh-27qj-w836
• https://nvd.nist.gov/vuln/detail/CVE-2026-49297
• https://github.com/apache/airflow/pull/67667
• https://github.com/apache/airflow/commit/0385bae70553223677753047b3e779d8b86b15c4
• https://github.com/apache/airflow
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-google/PYSEC-2026-2084.yaml
• https://lists.apache.org/thread/cb5nvoxsj1q7rv878cyqgtg150w0zglq?users@airflow.apache.org
• http://www.openwall.com/lists/oss-security/2026/07/04/8

CVE-2026-49297 · published 2026-07-06T12:31:30Z · modified 2026-09-04T19:40:33.043155846Z · JSON