Live › vulnerability › CVE-2023-25691
Go to dashboardThe Google provider for Apache Airflow, a Python package, fails to validate input properly before 8.10.0. The sources do not say exactly what input is affected, but the advisory rates it critical (CVSS 9.8), which points to remote, unauthenticated abuse.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:16 UTC, 0h before NVD. All times on this page are UTC.
Teams running Apache Airflow with the Google provider package installed at a version before 8.10.0. The sources do not say which Google provider features or configurations are needed to trigger the flaw. Teams without the Google provider installed are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| apache-airflow-providers-google | pypi | < 8.10.0 | 8.10.0 |
| apache apache-airflow-providers-google | vendor | < 8.10.0 | 8.10.0 |
pip show apache-airflow-providers-google and check whether the version is below 8.10.0airflow providers list and look for apache-airflow-providers-googleapache-airflow-providers-google to 8.10.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
This issue affects Apache Airflow Google Provider versions before 8.10.0.
This page as .md · .json · in your agent: get_signal("CVE-2023-25691")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.