Apache Airflow · Apache-Airflow-Providers-Smtp · CVE-2026-41016
**Name of the Vulnerable Software and Affected Versions**
apache-airflow-providers-smtp (affected versions not specified)
**Description**
The `SmtpHook` component in the SMTP provider calls the Python function `smtplib.SMTP.starttls()` without an SSL context. This omission prevents certificate validation during the TLS upgrade. Consequently, a man-in-the-middle attacker positioned between the Airflow worker and the SMTP server could present a self-signed certificate to complete the STARTTLS upgrade and capture SMTP credentials transmitted during the `login()` call.
**Recommendations**
Upgrade to the version of `apache-airflow-providers-smtp` that contains the fix.