What is the CVSS score of EUVD-2026-41869?

EUVD-2026-41869 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Apache Airflow Providers Google are affected by EUVD-2026-41869?

Apache Airflow's Google provider contains a path traversal vulnerability (CVE-2026-49297, CVSS 8.1) affecting versions before 22.2.1.. A patch is available.

How to fix or mitigate EUVD-2026-41869?

Within 24 hours: Audit current apache-airflow-providers-google version across all Airflow deployments and identify active use of GCSToSFTPOperator and GCSTimeSpanFileTransformOperator. Within 7 days: Stage apache-airflow-providers-google 22.2.1 in development/staging and validate dependent workflows complete without breaking changes. Within 30 days: Deploy 22.2.1+ to production and audit SFTP server and worker host file modification logs for unauthorized changes dating back 90 days.

Apache Airflow Providers Google EUVD-2026-41869

| CVE-2026-49297 HIGH

Path Traversal (CWE-22)

2026-07-04

GHSA-v3mh-27qj-w836

Apache Path Traversal Google Apache Airflow Providers Google

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Attacker needs write access to the source bucket (PR:L) and acts over the network; no confidentiality loss, but arbitrary file overwrite yields high integrity and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 21:37 vuln.today

v5 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:36 vuln.today

v4 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 21:34 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 06, 2026 - 21:34 vuln.today

Analysis Updated

Jul 06, 2026 - 21:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 20:22 NVD

8.1 (HIGH)

Patch available

Jul 06, 2026 - 12:01 EUVD

Analysis Generated

Jul 04, 2026 - 08:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Path Traversal in Apache Airflow Google Provider - CVE-2026-49297 Jul 04, 2026

AnalysisAI

Path traversal in Apache Airflow's Google provider (apache-airflow-providers-google before 22.2.1) lets a principal with write access to a source GCS bucket overwrite arbitrary files on the SFTP server (GCSToSFTPOperator) or the worker host (GCSTimeSpanFileTransformOperator) by crafting a GCS object name containing .. segments. Because the bucket writer is frequently a lower-trust party than the DAG author (partner uploads, ingest-only service accounts, public-data buckets), exploitation crosses a trust boundary that operators may not have modeled. No public exploit is identified at time of analysis, and CISA SSVC rates exploitation as none, so this is a real but non-default, targeted-risk integrity flaw rather than a mass-exploitable one.