SMTP Provider Vulnerability in Apache Airflow

CVE-2026-41016

What is CVE-2026-41016?

A vulnerability in Apache Airflow's SMTP provider arises from the lack of SSL context when calling the smtplib.SMTP.starttls() method. This oversight allows a man-in-the-middle attacker to exploit the TLS upgrade process by presenting a self-signed certificate, enabling them to intercept the SMTP credentials sent during subsequent authentication attempts. Users are encouraged to update to the latest version of the apache-airflow-providers-smtp package to mitigate this risk and ensure secure email communication.

References