Airflow Google provider CVE-2026-81914

Requires a deployment that passes externally-sourced names into the Google Drive hook - specifically wildcard gcs_to_gdrive transfers whose source GCS bucket is writable by a less-trusted principal (external data producer or ingest-only service account) distinct from the DAG author. The attacker must be able to create/name objects in that source bucket, and the affected apache-airflow-providers-google version must be below 22.6.0. It does NOT affect Airflow deployments where Drive query names are author-controlled or where this transfer pattern is not used, which sharply limits the real-world attack surface. No Airflow authentication or user interaction is needed; the injection triggers automatically when the DAG runs.

No CVSS vector, EPSS score, KEV entry, or public POC is provided for this issue, so quantitative exploitation signals are entirely absent - the only severity input is Apache's own rating of 'low'. My independent assessment agrees this is a genuinely low-priority, integrity-oriented flaw rather than a high-CVSS-but-low-real-risk mismatch. Exploitation is not remote-unauthenticated against Airflow itself: it requires an attacker who is a distinct trust principal (an external data producer or ingest-only service account) with the ability to create objects in a source GCS bucket, and it only bites deployments running the specific wildcard gcs_to_gdrive transfer pattern. The impact is limited to steering which Drive file/folder a hook resolves (misdirected upload destination or a substituted download) - no code execution, no direct large-scale data disclosure. This is 'no public exploit identified at time of analysis'; the flaw was found by an automated tool (Claude Security Scans) and remediated proactively, which further argues against active exploitation. Net: real but low priority, worth patching on normal cadence for GCP-integrated Airflow deployments.

An external data producer with write access to a GCS source bucket names an uploaded object with an embedded apostrophe followed by an injected Drive query clause. When an Airflow DAG runs a wildcard gcs_to_gdrive transfer, the unescaped name terminates the single-quoted literal early and appends attacker-chosen clauses, broadening the Drive search so a download returns the attacker's most-recently-modified file or an upload is steered into a folder the attacker named. No public exploit code is identified at time of analysis.