Jarek Potiuk

Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions