What is the CVSS score of CVE-2026-49297?

CVE-2026-49297 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Apache Airflow Providers Google are affected by CVE-2026-49297?

Apache Airflow's Google provider contains a path traversal vulnerability (CVE-2026-49297, CVSS 8.1) affecting versions before 22.2.1.. A patch is available.

How to fix or mitigate CVE-2026-49297?

Within 24 hours: Audit current apache-airflow-providers-google version across all Airflow deployments and identify active use of GCSToSFTPOperator and GCSTimeSpanFileTransformOperator. Within 7 days: Stage apache-airflow-providers-google 22.2.1 in development/staging and validate dependent workflows complete without breaking changes. Within 30 days: Deploy 22.2.1+ to production and audit SFTP server and worker host file modification logs for unauthorized changes dating back 90 days.

Apache Airflow Providers Google CVE-2026-49297

EUVD-2026-41869 HIGH

Path Traversal (CWE-22)

2026-07-04

GHSA-v3mh-27qj-w836

Apache Path Traversal Google Apache Airflow Providers Google

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Attacker needs write access to the source bucket (PR:L) and acts over the network; no confidentiality loss, but arbitrary file overwrite yields high integrity and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:37 vuln.today

v5 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:36 vuln.today

v4 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:34 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 06, 2026 - 21:34 vuln.today

Analysis Updated

Jul 06, 2026 - 21:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

8.1 (HIGH)

Patch available

Jul 06, 2026 - 12:01 EUVD

Analysis Generated

Jul 04, 2026 - 08:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Path Traversal in Apache Airflow Google Provider - CVE-2026-49297 Jul 04, 2026

AnalysisAI

Path traversal in Apache Airflow's Google provider (apache-airflow-providers-google before 22.2.1) lets a principal with write access to a source GCS bucket overwrite arbitrary files on the SFTP server (GCSToSFTPOperator) or the worker host (GCSTimeSpanFileTransformOperator) by crafting a GCS object name containing .. segments. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Audit current apache-airflow-providers-google version across all Airflow deployments and identify active use of GCSToSFTPOperator and GCSTimeSpanFileTransformOperator. …

Threat intelligence, references, and detailed analysis are available after sign-in.