Apache Airflow: improper certificate validation

CVE-2026-32794 · Published Mar 31, 2026 · updated Jul 13, 2026

Medium4.8

Fix: upgrade to 1.12.0 or later

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.

This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Affected versions

Package	Affected	Fixed in
apache-airflow PyPI	>= 1.10.0, < 1.12.0	1.12.0

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-295
Also known as: CVE-2026-32794, PYSEC-2026-2357

More Apache Airflow advisories

All Apache Airflow

High 8.8Apr 13

Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom APICVE-2026-33858fixed in 3.2.0 MediumApr 13

Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UICVE-2025-66236fixed in 3.2.0 Critical 9.1Apr 9

Apache Airflow: JWT token still valid after logoutCVE-2025-57735fixed in 3.2.0 Medium 6.5Apr 9

Apache Airflow has an authorization bypass in DagRun wait endpointCVE-2026-34538fixed in 3.2.0 High 7.5Mar 17

Apache Airflow: resource exposureCVE-2026-28779fixed in 3.1.8 High 8.1Mar 17

Apache Airflow: Execution API HITL Endpoints Missing Per-Task AuthorizationCVE-2026-30911fixed in 3.1.8