Posted by Shahar Epstein on Sep 29 Severity: moderate Affected versions: - Apache Airflow Snowflake provider before 6.18.0 Description: Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path,...
CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/986
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may…
OperTraitors: How Kubernetes Operators Betray Your Security Posture
We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities.
Fake iPhone Duo preorder scam triggers DarkSword attack
Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of…
Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)
Apple has shipped iOS and macOS security updates to fix an actively exploited zero-day vulnerability (CVE-2026-86950) in the operating systems’ Core Graphics framework…
CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag
Posted by Shahar Epstein on Sep 29 Severity: low Affected versions: - Apache Airflow Teradata provider before 3.7.0 Description: The Apache Airflow Teradata provider's…
CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
Posted by Shahar Epstein on Sep 29 Severity: low Affected versions: - Apache Airflow Google provider before 22.6.0 Description: Apache Airflow's Google provider built…