{"id":"CVE-2023-25691","kind":"vulnerability","aliases":["CVE-2023-25691","GHSA-8g23-2q5p-8866"],"related":[],"title":"Apache Airflow Google Provider Improper Input Validation vulnerability","description":"Improper Input Validation vulnerability in the Apache Airflow Google Provider.\n\nThis issue affects Apache Airflow Google Provider versions before 8.10.0.","summary":"The Google provider for Apache Airflow, a Python package, fails to validate input properly before 8.10.0. The sources do not say exactly what input is affected, but the advisory rates it critical (CVSS 9.8), which points to remote, unauthenticated abuse.","severity":"critical","cvss":9.8,"epss":0.01597,"exploited":false,"exploited_at":null,"products":[{"name":"apache-airflow-providers-google","fixed":["8.10.0"],"affected":"< 8.10.0","ecosystem":"pypi"},{"name":"apache apache-airflow-providers-google","fixed":["8.10.0"],"affected":"< 8.10.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["airflow","cwe-20","data-pipelines","gcp","package","python"],"not_affected_if":["provider-not-installed","version-8.10.0-or-later"],"how_to_check":"- Run `pip show apache-airflow-providers-google` and check whether the version is below `8.10.0`\n- Check the installed provider with `airflow providers list` and look for `apache-airflow-providers-google`","fix":"- Upgrade `apache-airflow-providers-google` to `8.10.0` or later\n- Restart the Airflow scheduler, webserver and workers after the upgrade","status":"open","published_at":"2023-02-24T12:15:30+00:00","first_seen_at":"2026-10-26T21:16:46+00:00","triaged_at":"2026-10-26T21:16:58+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T21:16:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `apache-airflow-providers-google` to `8.10.0` or later\n- Restart the Airflow scheduler, webserver and workers after the upgrade","reach":"unknown","title":"Apache Airflow Google provider: improper input validation lets attackers run tasks","impact":"high","summary":"The Google provider for Apache Airflow, a Python package, fails to validate input properly before 8.10.0. The sources do not say exactly what input is affected, but the advisory rates it critical (CVSS 9.8), which points to remote, unauthenticated abuse.","category":"package","nicknames":[],"who_cares":["airflow","python","gcp","data-pipelines"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown exploit impact; advisory rates it critical","analyst_note":"Read GHSA-8g23-2q5p-8866 for the affected input path, required access and exploit details; the sources here give only the CVSS score and the version range.","how_to_check":"- Run `pip show apache-airflow-providers-google` and check whether the version is below `8.10.0`\n- Check the installed provider with `airflow providers list` and look for `apache-airflow-providers-google`","needs_analyst":true,"not_affected_if":["provider-not-installed","version-8.10.0-or-later"],"who_is_affected":"Teams running Apache Airflow with the Google provider package installed at a version before 8.10.0. The sources do not say which Google provider features or configurations are needed to trigger the flaw. Teams without the Google provider installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000622,"input_tokens":3321,"output_tokens":580,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-20':33B '-2023':10A,18A '-25691':11A,19A '2q5p':15A '8.10.0':55B,99C '8866':16A '8g23':14A '9.8':73B 'abus':79B 'advisori':68B 'affect':65B,92C 'airflow':2A,22A,28A,31B,45B,87C,94C 'apach':1A,44B,86C,93C 'apache':21A,25A,27A 'apache-airflow-providers-google':20A,26A 'critic':71B 'cve':9A,17A 'cvss':72B 'cwe':32B 'data':35B 'data-pipelin':34B 'exact':61B 'fail':49B 'gcp':37B 'ghsa':13A 'ghsa-8g23-2q5p':12A 'googl':3A,41B,88C,95C 'google':24A,30A 'improp':5A,80C 'input':6A,52B,63B,81C 'issu':91C 'packag':38B,48B 'pipelin':36B 'point':75B 'proper':53B 'provid':4A,42B,89C,96C 'providers':23A,29A 'python':39B,47B 'rate':69B 'remot':77B 'say':60B 'sourc':57B 'unauthent':78B 'valid':7A,51B,82C 'version':97C 'vulner':8A,83C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Airflow with the Google provider package installed at a version before 8.10.0. The sources do not say which Google provider features or configurations are needed to trigger the flaw. Teams without the Google provider installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-02-24T12:15:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8g23-2q5p-8866","url":"https://github.com/advisories/GHSA-8g23-2q5p-8866","severity":"critical","published_at":"2023-02-24T12:31:20+00:00","modified_at":"2026-10-26T21:16:36+00:00","first_seen_at":"2026-10-26T21:16:46+00:00","fetched_at":"2026-10-26T21:21:58+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-25691","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25691","severity":null,"published_at":"2023-02-24T12:15:30+00:00","modified_at":"2026-06-17T05:41:44+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}