CVE-2026-81914: Apache Airflow Google Drive SQLI Vulnerability

CVE-2026-81914 Overview

CVE-2026-81914 is a query injection vulnerability in the Apache Airflow Google provider. The flaw affects how the Google Drive hook builds search expressions. File and folder names are interpolated directly into single-quoted string literals without escaping the quote character. A name containing an apostrophe terminates the literal early and appends attacker-controlled clauses to the query. The issue is classified under [CWE-943] Improper Neutralization of Special Elements in Data Query Logic.

Critical Impact
Attackers who can create objects in a source Google Cloud Storage (GCS) bucket used by gcs_to_gdrive wildcard transfers can steer uploads into folders they control and cause downloads to return files they placed rather than the intended files.

Affected Products

Apache Airflow Google provider (apache-airflow-providers-google) versions prior to 22.6.0
Airflow deployments using the Google Drive hook with externally-sourced names
Wildcard gcs_to_gdrive transfers from GCS buckets writable by less-trusted principals

Discovery Timeline

2026-09-29 - CVE-2026-81914 published to the National Vulnerability Database (NVD)
2026-09-29 - Disclosed on the Apache dev mailing list and OSS-Security list
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-81914

Vulnerability Analysis

The Google provider constructs Google Drive search expressions by concatenating file and folder names into single-quoted string literals. The code does not escape the single quote character that delimits those literals. A name such as report' and trashed=false or name='attacker closes the intended literal and injects additional query clauses.

The consequences depend on how the injected clauses shift the query result set. An upload can be redirected into an attacker-named folder because the hook resolves the folder by name. A download can return an attacker-placed file because the hook selects the most recently modified match from the widened result set. The attacker never needs Airflow credentials — only write access to a data source consumed by a Dag.

Root Cause

The root cause is missing input neutralization for Google Drive query syntax. Values interpolated into a Drive query must have ' and \ characters escaped, because Drive queries treat single quotes as string delimiters and backslashes as escape characters. The pre-22.6.0 provider treated externally-sourced names as trusted query fragments rather than as untrusted data.

Attack Vector

Exploitation requires an attacker to control an object name in a data source used by an Airflow Dag. In the documented gcs_to_gdrive wildcard transfer scenario, that source is a GCS bucket. Any principal able to create objects in that bucket — for example, an external data producer or an ingest-only service account — can craft an object whose name contains a single quote followed by injected Drive query clauses. When the Dag lists the bucket and passes the name to the Google Drive hook, the injected clauses execute against Drive with the Dag's Drive credentials. The trust boundary crossed is between the bucket writer and the Dag author, which are typically distinct principals.

See the Apache Airflow pull request 72166 for the reference fix and the Apache mailing list disclosure for the vendor advisory.

Detection Methods for CVE-2026-81914

Indicators of Compromise

GCS or Drive object names containing single quote characters, particularly followed by Drive query keywords such as and, or, trashed, mimeType, or name=
Airflow task logs showing gcs_to_gdrive transfers resolving folders or files whose names differ from the Dag's configured target
Drive API request logs from Airflow service accounts containing query strings with unexpected boolean clauses

Detection Strategies

Audit GCS bucket listings for objects whose names contain ', \, or Drive query operators
Review Airflow task history for GoogleDriveHook and GCSToGoogleDriveOperator invocations against buckets writable by external principals
Correlate Drive audit logs with expected Dag behavior to identify unexpected file resolutions or folder placements

Monitoring Recommendations

Enable Google Workspace Drive audit logging and forward events to a central data lake for query analysis
Alert on Drive API queries originating from Airflow service accounts that contain unescaped quote patterns
Track the installed version of apache-airflow-providers-google across Airflow environments and flag versions below 22.6.0

How to Mitigate CVE-2026-81914

Immediate Actions Required

Upgrade apache-airflow-providers-google to 22.6.0 or later on every Airflow scheduler, worker, and triggerer
Inventory Dags that use GCSToGoogleDriveOperator with wildcard source paths and identify the trust level of the source buckets
Restrict write access to source GCS buckets so that only trusted principals can create objects consumed by Drive-bound Dags

Patch Information

The fix is included in apache-airflow-providers-google22.6.0. The patched hook escapes quote and backslash characters in every value interpolated into a Drive query. See Apache Airflow pull request 72166 for the code change and the OSS-Security disclosure for the announcement.

Workarounds

Reject or rename source objects whose names contain ' or \ before Dag execution using a validation task
Replace wildcard gcs_to_gdrive transfers with explicit file lists sourced from a trusted control plane
Segregate ingest buckets from Drive-bound processing buckets and require a validation stage between them

bash

# Upgrade the Google provider on Airflow hosts
pip install --upgrade 'apache-airflow-providers-google>=22.6.0'

# Verify the installed version
pip show apache-airflow-providers-google | grep -i version