PT-2026-29132 · Apache · Apache Airflow Provider For Databricks

Kai Aizen + 1 · CVE-2026-32794 · Publicado 2026-03-30 · Atualizado 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow Provider for Databricks versions 1.10.0 through 1.11.9

Description The software does not properly validate certificates when connecting to Databricks, potentially allowing a man-in-the-middle attack where traffic is intercepted, manipulated, or credentials are stolen without the user being notified.

Recommendations Upgrade to version 1.12.0 to resolve the issue.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2026-32794

GHSA-WRPJ-755P-X363

PYSEC-2026-2357

Produtos afetados

Apache Airflow Provider For Databricks

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32794.json · Exploit
• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/63704 · Correção
• https://osv.dev/vulnerability/PYSEC-2026-2357 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/03/30/9 · Nota
• https://github.com/advisories/GHSA-wrpj-755p-x363 · Nota
• https://osv.dev/vulnerability/CVE-2026-32794 · Aviso do Fabricante
• https://twitter.com/oss_security/status/2038771098733453704 · Publicação no Twitter
• https://pypi.org/project/apache-airflow · Nota
• https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wrpj-755p-x363 · Aviso do Fabricante
• https://pypi.python.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32794 · Nota de Segurança
• https://twitter.com/CVEnew/status/2038916069168164974 · Publicação no Twitter