2 results · Clear filters · Feed
-
Medium 4.3
Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore termi…
-
Medium 6.5
Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every…