CVE-2026-49297: Apache Airflow Google Provider Path Traversal in GCS Operators

Technical summary

The `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` in the Apache Airflow Google provider fail to normalize or validate GCS object names before constructing filesystem paths. When the bucket listing API returns object metadata, those names are directly concatenated with the destination path without stripping path traversal sequences. An attacker with write access to the source GCS bucket can create objects with names like `../../sensitive/file` to escape the intended destination directory. For `GCSToSFTPOperator`, this enables arbitrary file writes on the SFTP server; for `GCSTimeSpanFileTransformOperator`, the escape occurs within the worker's temporary directory structure, risking compromise of the execution environment itself.

Business impact

In production Airflow deployments that pull data from external GCS buckets—common in data lake, ETL, and SaaS integration scenarios—this vulnerability bridges a trust boundary. Partner organizations, ingest-only service accounts, or contributors to public-data buckets gain the ability to corrupt or replace files on downstream systems (SFTP servers, worker nodes) without DAG author intent. For organizations in regulated industries or with strict data integrity requirements, unauthorized file modification on backend systems represents both a compliance risk and operational risk, potentially triggering incident response and audit burden.

Affected systems

Apache Airflow deployments using `apache-airflow-providers-google` versions prior to 22.2.1 are affected. The vulnerability is only exploitable in configurations where DAGs use `GCSToSFTPOperator` or `GCSTimeSpanFileTransformOperator` to transfer data from GCS buckets with multi-principal write access. Self-hosted and managed Airflow environments (including Composer on Google Cloud) are in scope if they depend on the vulnerable provider version and ingest from less-trusted buckets.

Exploitability

Exploitability requires two conditions: (1) write access to the source GCS bucket by a principal outside the core DAG/platform team (low bar in partner or public data scenarios), and (2) active DAG execution that triggers the operator. No authentication beyond GCS write permission or Airflow execution is required. The attack surface is broad for organizations using Airflow as a data federation hub. However, the vulnerability is not remotely exploitable without pre-existing bucket write access, and code execution on the target system is not guaranteed—impact is limited to file overwrite.

Remediation

Upgrade `apache-airflow-providers-google` to version 22.2.1 or later. This patch adds path normalization and containment validation to both operators, ensuring that object names are resolved within the configured destination directory and that `..` sequences cannot escape. After patching, restart all Airflow scheduler, webserver, and worker processes to load the updated provider code. For immediate risk reduction pending patches, restrict GCS bucket write permissions to trusted principals only, or disable these operators if the data source cannot be verified.

Patch guidance

Apply `apache-airflow-providers-google >= 22.2.1` via your package manager (pip, conda, or your Airflow environment's dependency tool). If you use Apache Airflow in a containerized or managed environment (e.g., Cloud Composer), check your platform's provider release notes and update the Google provider version in your environment configuration. Test the update in a non-production environment first, as provider upgrades can affect operator behavior or logging. Verify that affected DAGs continue to function normally post-patch.

Detection guidance

Monitor Airflow task logs for unexpected file creation or modification on SFTP servers and worker hosts, particularly in directories outside the configured `destination_path`. Check GCS bucket audit logs for object creation with `..` in the name or other path traversal patterns. Review DAG configurations to identify use of `GCSToSFTPOperator` or `GCSTimeSpanFileTransformOperator` with source buckets that have non-owner write permissions. Implement file integrity monitoring (FIM) on SFTP servers and worker nodes to flag unauthorized changes.

Why prioritize this

This vulnerability merits immediate attention for organizations that combine (1) Airflow as a data orchestration platform, (2) GCS as a data source with federated write access, and (3) SFTP or shared worker infrastructure as a target. It bridges a trust boundary and enables data integrity attacks without requiring direct system compromise. The CVSS 8.1 score reflects the high impact (file overwrite) and low barrier to exploit (requires only bucket write access, which is often delegated in data-sharing scenarios). Organizations in finance, healthcare, or supply-chain sectors should prioritize this patch.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: Attack Vector = Network (DAG execution is triggered over HTTP), Attack Complexity = Low (no special conditions needed), Privileges Required = Low (only GCS bucket write permission), User Interaction = None (automated DAG execution), Scope = Unchanged, Integrity = High (files can be overwritten), Availability = High (critical system files could be corrupted). Confidentiality is not impacted because the vulnerability does not enable file read. The score appropriately escalates the risk due to the intersection of automation, trust delegation, and multi-system impact.

Frequently asked questions