CVE-2026-49297: Apache Airflow Google Path Traversal Flaw

CVE-2026-49297 Overview

CVE-2026-49297 is a path traversal vulnerability [CWE-22] in the Apache Airflow Google provider package. The GCSToSFTPOperator and GCSTimeSpanFileTransformOperator join Google Cloud Storage (GCS) object names returned by the bucket listing API directly to a destination filesystem path. The operators perform no normalization or containment check on those names.

A principal with write access to the source bucket can create an object whose name contains .. segments. When a DAG run downloads that object, the write escapes the configured destination directory. Affected deployments are those that ingest from buckets writable by less-trusted principals such as partner uploads, ingest-only service accounts, or public-data buckets.

Critical Impact
Attackers with GCS write access can overwrite arbitrary files on the SFTP server or the Airflow worker host, enabling code execution paths and data integrity compromise.

Affected Products

apache-airflow-providers-google versions prior to 22.2.1
Deployments using GCSToSFTPOperator
Deployments using GCSTimeSpanFileTransformOperator

Discovery Timeline

2026-07-06 - CVE-2026-49297 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49297

Vulnerability Analysis

The flaw lives in how the two operators construct destination paths. Each operator lists objects in a source GCS bucket and then concatenates the raw object name onto a base path. GCSToSFTPOperator appends the object name to the configured SFTP destination_path. GCSTimeSpanFileTransformOperator appends it to a worker-local temporary directory before invoking a user-supplied transform script.

Because GCS object names may contain arbitrary characters including forward slashes and .. segments, the resulting path can resolve outside the intended directory. The operators do not call any normalization routine such as os.path.normpath followed by a prefix check against the base directory. This makes the vulnerability a straightforward instance of Zip Slip-style path traversal applied to object storage ingest.

Exploitation requires only write access to the source bucket, which is often a different trust boundary from the Airflow deployment. The confidentiality impact is none, but integrity and availability impacts are high because attacker-controlled bytes land at attacker-chosen paths.

Root Cause

The root cause is missing input validation on untrusted object names before path composition. GCS treats object names as opaque strings and does not reject .. sequences. The operators trusted the listing API output as safe filename components, violating the principle that any name crossing a trust boundary must be sanitized before use as a filesystem path.

Attack Vector

An attacker uploads an object to the monitored GCS bucket with a name such as ../../etc/cron.d/pwn or ../../../home/airflow/.ssh/authorized_keys. When the scheduled DAG runs GCSToSFTPOperator, the SFTP client writes the object content to the traversed location on the SFTP server. For GCSTimeSpanFileTransformOperator, the write targets the Airflow worker host, allowing overwrites of DAG files, systemd units, or SSH configuration and leading to code execution as the worker user.

See the Apache Airflow security advisory and the upstream fix pull request for the technical fix details.

Detection Methods for CVE-2026-49297

Indicators of Compromise

GCS objects with names containing .. path segments, leading slashes, or absolute-path patterns in ingest buckets
Unexpected file writes on Airflow worker hosts outside of standard temp directories such as /tmp/airflowtmp*
Modifications to SFTP server files outside the configured destination_path timestamped near DAG execution windows
New or modified files in sensitive locations such as ~/.ssh/authorized_keys, /etc/cron.d/, or DAG source directories

Detection Strategies

Enable GCS audit logging and alert on object creations where the object name contains .. or begins with /
Correlate Airflow task logs for GCSToSFTPOperator and GCSTimeSpanFileTransformOperator runs with filesystem change events on target hosts
Add file integrity monitoring on SFTP servers and Airflow workers for paths outside declared operator destinations

Monitoring Recommendations

Inventory all DAGs invoking the two affected operators and record their source buckets and destination paths
Track the apache-airflow-providers-google package version deployed on every scheduler and worker node
Log all writes performed by the Airflow worker service account and flag paths that deviate from expected task output directories

How to Mitigate CVE-2026-49297

Immediate Actions Required

Upgrade apache-airflow-providers-google to version 22.2.1 or later across all Airflow schedulers and workers
Audit source GCS buckets used by GCSToSFTPOperator and GCSTimeSpanFileTransformOperator for objects with traversal patterns and delete them
Restrict write access on ingest buckets to trusted principals until the upgrade is complete
Review recent DAG run logs and target host filesystems for signs of writes outside configured destinations

Patch Information

The Apache Airflow project fixed the issue in apache-airflow-providers-google 22.2.1. The fix normalizes object names and validates that the resolved destination path stays within the configured base directory. Details are available in the GitHub pull request 67667 and the Openwall oss-security posting.

Workarounds

Replace affected operators with custom logic that validates object names against a strict allowlist regex before download
Route ingest through an intermediate bucket populated only by trusted service accounts that sanitize object names on copy
Run Airflow workers under a low-privilege user with no write access to sensitive system paths and mount destination directories read-only where feasible

bash

# Upgrade the provider package on schedulers and workers
pip install --upgrade 'apache-airflow-providers-google>=22.2.1'

# Verify installed version
pip show apache-airflow-providers-google | grep -i version