PT-2026-29132 · Apache · Apache Airflow Provider For Databricks

Kai Aizen + 1 · Published 2026-03-30 · Updated 2026-03-31 · CVE-2026-32794

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow Provider for Databricks versions 1.10.0 through 1.11.9

Description The software does not properly validate certificates when connecting to Databricks, potentially allowing a man-in-the-middle attack where traffic is intercepted, manipulated, or credentials are stolen without the user being notified.

Recommendations Upgrade to version 1.12.0 to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-32794

GHSA-WRPJ-755P-X363

Affected Products

Apache Airflow Provider For Databricks

References · 8

• https://github.com/apache/airflow/pull/63704 · Patch
• https://osv.dev/vulnerability/GHSA-wrpj-755p-x363 · Vendor Advisory
• https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32794 · Security Note
• https://github.com/apache/airflow · Note
• https://twitter.com/oss_security/status/2038771098733453704 · Twitter Post
• http://openwall.com/lists/oss-security/2026/03/30/9 · Note
• https://twitter.com/CVEnew/status/2038916069168164974 · Twitter Post