Jarek Potiuk

Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain

Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false