---
id: "CVE-2023-25691"
kind: "vulnerability"
aliases: ["CVE-2023-25691", "GHSA-8g23-2q5p-8866"]
title: "Apache Airflow Google Provider Improper Input Validation vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.01597
exploited: false
status: "open"
category: "package"
products: [{"name": "apache-airflow-providers-google", "fixed": ["8.10.0"], "affected": "< 8.10.0", "ecosystem": "pypi"}, {"name": "apache apache-airflow-providers-google", "fixed": ["8.10.0"], "affected": "< 8.10.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["airflow", "cwe-20", "data-pipelines", "gcp", "package", "python"]
not_affected_if: ["provider-not-installed", "version-8.10.0-or-later"]
published_at: "2023-02-24T12:15:30+00:00"
first_seen_at: "2026-10-26T21:16:46+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-8g23-2q5p-8866", "first_seen_at": "2026-10-26T21:16:46+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25691", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# Apache Airflow Google Provider Improper Input Validation vulnerability

The Google provider for Apache Airflow, a Python package, fails to validate input properly before 8.10.0. The sources do not say exactly what input is affected, but the advisory rates it critical (CVSS 9.8), which points to remote, unauthenticated abuse.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:apache-airflow-providers-google affected < 8.10.0 fixed 8.10.0
- vendor:apache apache-airflow-providers-google affected < 8.10.0 fixed 8.10.0

## How to check

- Run `pip show apache-airflow-providers-google` and check whether the version is below `8.10.0`
- Check the installed provider with `airflow providers list` and look for `apache-airflow-providers-google`

## Fix

- Upgrade `apache-airflow-providers-google` to `8.10.0` or later
- Restart the Airflow scheduler, webserver and workers after the upgrade

## Timeline

- 2026-10-26T21:16:46+00:00 ghsa https://github.com/advisories/GHSA-8g23-2q5p-8866
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-25691

## From the sources

Improper Input Validation vulnerability in the Apache Airflow Google Provider.

This issue affects Apache Airflow Google Provider versions before 8.10.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_