CVE-2026-41016
published 2026-04-30CVE-2026-41016: Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the…
PriorityP432medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.27%
18.5th percentile
Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | airflow | >= 2.0.0 < 3.0.0 | 3.0.0 |
| apache | airflow | >= 2.0.0 < 3.2.2 | 3.2.2 |
| apache_software_foundation | apache_airflow | >= 2.0.0 < 3.2.2 | 3.2.2 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
ghsa5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_st
ghsa_unreviewed·2026-06-01·CVSS 5.9
CVE-2026-49267 [MEDIUM] CWE-295 Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_st
Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_starttls=True` without `[email] smtp_ssl`. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could present a self-signed certificate, have the worker complete the STARTTLS handshake silently, and capture the SMTP AUTH credentials and message contents the worker forwarded.
This CVE covers the **core apache-airflow side** of the same root cause already covered for the SMTP provider by `CVE-2026-41016` (published 2026-04-27, covering `apache-
GHSA
Apache Airflow has no certificate validation on SMTP STARTTLS connections
ghsa·2026-06-01·CVSS 5.9
CVE-2026-49267 [MEDIUM] CWE-295 Apache Airflow has no certificate validation on SMTP STARTTLS connections
Apache Airflow has no certificate validation on SMTP STARTTLS connections
Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_starttls=True` without `[email] smtp_ssl`. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could present a self-signed certificate, have the worker complete the STARTTLS handshake silently, and capture the SMTP AUTH credentials and message contents the worker forwarded.
This CVE covers the **core apache-airflow side** of the same root cause already covered for the
GHSA
GHSA-x8mh-94wc-33gv: Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib
ghsa_unreviewed·2026-04-30
CVE-2026-41016 [MEDIUM] CWE-295 GHSA-x8mh-94wc-33gv: Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib
Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.
GHSA
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
ghsa·2026-04-30
CVE-2026-41016 [MEDIUM] CWE-295 apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-30
Published