Executive brief
Apache Airflow, a platform used to programmatically author and schedule workflows, failed to verify security certificates when sending emails via encrypted SMTP connections. An attacker positioned on the network between Airflow and the email server could intercept sensitive information, including email login credentials and the contents of the messages being sent. This could lead to unauthorized access to email accounts and the exposure of confidential business data contained in automated reports or alerts.
Technical details
A vulnerability in Apache Airflow's core `airflow.utils.email` helpers and `EmailOperator` results in improper certificate validation (CWE-295) when `smtp_starttls` is enabled without `smtp_ssl`. An attacker capable of performing a network man-in-the-middle (MITM) attack can present a self-signed certificate that the worker will silently accept. This allows the attacker to intercept the STARTTLS handshake, capturing SMTP AUTH credentials and the plaintext content of forwarded emails. This issue is the core-side counterpart to a similar vulnerability in the SMTP provider (CVE-2026-41016). The vulnerability is addressed in Apache Airflow version 3.2.2.
Affected products
- Apache Airflow >= 2.0.0, < 3.2.2
Timeline
- 2026-04-27: other: Related provider vulnerability CVE-2026-41016 published
- 2026-06-01: advisory
- 2026-06-01: disclosed
References
- https://api.github.com/users/francisbergin
- https://github.com/francisbergin
- https://api.github.com/users/francisbergin/gists%7B/gist_id%7D
- https://api.github.com/users/francisbergin/repos
- https://avatars.githubusercontent.com/u/198925343?v=4
- https://api.github.com/users/francisbergin/events%7B/privacy%7D