Jarek Potiuk

Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain

Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity