Executive brief
A security flaw in the Apache Airflow SMTP provider allows attackers to intercept sensitive email credentials. This occurs because the software fails to verify the identity of the mail server when establishing a secure connection. An attacker positioned between the Airflow system and the mail server could steal login information, potentially leading to unauthorized access to corporate email accounts.
Technical details
The Apache Airflow SMTP provider's `SmtpHook` component fails to perform proper certificate validation. Specifically, it calls Python's `smtplib.SMTP.starttls()` without providing an SSL context, which results in the TLS upgrade proceeding without verifying the server's certificate. A network-positioned attacker (Man-in-the-Middle) can present a self-signed certificate to intercept the connection. Once the STARTTLS upgrade is completed insecurely, the attacker can capture the plaintext SMTP credentials transmitted during the subsequent `login()` call. This vulnerability is addressed in version 3.0.0 of the `apache-airflow-providers-smtp` package.
Affected products
- Apache Software Foundation apache-airflow-providers-smtp >= 2.0.0, < 3.0.0
Timeline
- 2026-04-30: advisory: GitHub Advisory published
- 2026-04-30: disclosed: NVD publication date
References
- https://api.github.com/users/francisbergin
- https://github.com/francisbergin
- https://api.github.com/users/francisbergin/gists%7B/gist_id%7D
- https://api.github.com/users/francisbergin/repos
- https://avatars.githubusercontent.com/u/198925343?v=4
- https://api.github.com/users/francisbergin/events%7B/privacy%7D