PT-2026-36084 · Apache Airflow · Apache-Airflow-Providers-Smtp

Francis Bergin + 1 · CVE-2026-41016 · Published 2026-04-30 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-smtp (affected versions not specified)

Description The SmtpHook component in the SMTP provider calls the Python function smtplib.SMTP.starttls() without an SSL context. This omission prevents certificate validation during the TLS upgrade. Consequently, a man-in-the-middle attacker positioned between the Airflow worker and the SMTP server could present a self-signed certificate to complete the STARTTLS upgrade and capture SMTP credentials transmitted during the login() call.

Recommendations Upgrade to the version of apache-airflow-providers-smtp that contains the fix.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CLEANSTART-2026-AZ09261

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-WQ85001

CVE-2026-41016

ECHO-0C21-09C6-A700

GHSA-X8MH-94WC-33GV

PYSEC-2026-24

Affected Products

Apache-Airflow-Providers-Smtp

References · 186

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41016.json · Exploit
• https://github.com/apache/airflow/pull/65346 · Patch
• https://osv.dev/vulnerability/CLEANSTART-2026-AZ09261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34069 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0994 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44681 · Security Note