CVE-2026-41016 Details
Description
Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.
A vulnerability exists in Apache Airflow's SMTP provider, specifically in the SmtpHook component, versions 2.0.0 prior to 3.0.0. The issue arises because the SmtpHook calls Python's smtplib.SMTP.starttls() without an SSL context, leading to a lack of certificate validation during the TLS upgrade. This flaw allows a man-in-the-middle attacker to intercept the connection between the Airflow worker and the SMTP server, present a self-signed certificate, complete the STARTTLS upgrade, and capture SMTP credentials during the subsequent login() call.
Users are advised to upgrade to the version of apache-airflow-providers-smtp that includes the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apache/airflow/pull/65346 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4 | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache airflow | >= 2.0.0, < 3.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | New CVE Received | [email protected] |