Apache AirflowGHSA-wrpj-755p-x363
Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
Medium4.8CVE-2026-32794 · Published Mar 31, 2026 · updated Jul 13, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 1.10.0, < 1.12.0 | 1.12.0 |
Details and references
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-295
- Also known as
- CVE-2026-32794, PYSEC-2026-2357
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 9 | Apache Airflow has an authorization bypass in DagRun wait endpoint CVE-2026-34538Medium6.5fixed in 3.2.0 | Medium6.5 | 3.2.0 |
| Apr 9 | Apache Airflow: JWT token still valid after logout CVE-2025-57735Critical9.1fixed in 3.2.0 | Critical9.1 | 3.2.0 |
| Mar 17 | Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications CVE-2026-28779High7.5fixed in 3.1.8 | High7.5 | 3.1.8 |
| Mar 17 | Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization CVE-2026-30911High8.1fixed in 3.1.8 | High8.1 | 3.1.8 |
| Mar 17 | Apache Airflow: DAG authorization bypass CVE-2026-28563Medium4.3fixed in 3.1.8 | Medium4.3 | 3.1.8 |
| Mar 17 | Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata CVE-2026-26929High7.5fixed in 3.1.8 | High7.5 | 3.1.8 |