Insufficient Certificate Verification in Apache Airflow's EmailOperator

CVE-2026-49267

What is CVE-2026-49267?

Apache Airflow's EmailOperator utilizes SMTP STARTTLS connections without proper verification of the remote certificate when configured with smtp_starttls=True and smtp_ssl=False. This oversight opens the door to potential man-in-the-middle attacks, where an attacker could intercept and exploit the connection by presenting a self-signed certificate. As a result, sensitive SMTP AUTH credentials and message content could be compromised. Users are urged to upgrade to Apache Airflow version 3.2.2 or later to ensure that these vulnerabilities are addressed adequately.

References