GitHub Advisoryadvisory · PyPI

GHSA-wrpj-755p-x363 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

MEDIUM Published 2026-03-31 Modified 2026-04-01 Official page ↗
Aliases
CVE-2026-32794
Ecosystem
PyPI
Packages
apache-airflow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-295
Reviewed
2026-04-01

Affected packages

• PyPI apache-airflow: >= 1.10.0, < 1.12.0 → fixed in 1.12.0

Description

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-32794 Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References