PT-2026-45382 · Apache · Apache Airflow

Francis Bergin + 1 · CVE-2026-49267 · Published 2026-06-01 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2

Description The EmailOperator and airflow.utils.email helpers establish SMTP STARTTLS connections without verifying the remote certificate when the deployment is configured with smtp starttls=True and smtp ssl=False. This allows an attacker positioned between the worker and the SMTP server to perform a Man-in-the-Middle (MITM) attack by presenting a self-signed certificate. Consequently, the attacker can silently complete the STARTTLS handshake and capture SMTP AUTH credentials and the contents of forwarded messages.

Recommendations Upgrade to version 3.2.2 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-AIRFLOW-2026-49267

CVE-2026-49267

GHSA-799X-QP47-8QWQ

PYSEC-2026-2346

Affected Products

Apache Airflow

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49267.json · Exploit
• https://github.com/apache/airflow/pull/65346 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49267 · Security Note
• https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2026-49267 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-799x-qp47-8qwq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2346 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49267 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://t.me/cveNotify/165761 · Telegram Post
• https://pypi.org/project/apache-airflow · Note
• https://pypi.python.org · Note
• https://t.me/CVEtracker/55464 · Telegram Post
• https://github.com/advisories/GHSA-799x-qp47-8qwq · Note