PT-2026-29132 · Apache · Apache Airflow Provider For Databricks

Kai Aizen + 1 · Publicado 2026-03-30 · Atualizado 2026-03-31 · CVE-2026-32794

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow Provider for Databricks versions 1.10.0 through 1.11.9

Description The software does not properly validate certificates when connecting to Databricks, potentially allowing a man-in-the-middle attack where traffic is intercepted, manipulated, or credentials are stolen without the user being notified.

Recommendations Upgrade to version 1.12.0 to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-32794

GHSA-WRPJ-755P-X363

Produtos afetados

Apache Airflow Provider For Databricks

Referências · 8

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/63704 · Correção
• https://twitter.com/CVEnew/status/2038916069168164974 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2026/03/30/9 · Nota
• https://twitter.com/oss_security/status/2038771098733453704 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-wrpj-755p-x363 · Aviso do Fabricante
• https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32794 · Nota de Segurança