Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Airflow Teradata provider

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-86843

    Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

    The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-cluster operators, which interpolate those values into Teradata DDL. A user who is …

    Apache Software Foundation Apache Airflow Teradata provider
  • Medium 6.5
    CVE-2026-81862

    Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

    Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOperator` interpolate the source bucket's credentials as plain string literals into the `CREATE MULTISET …

    Apache Software Foundation Apache Airflow Teradata provider