PT-2026-53375 · Pypi · Apache-Airflow-Providers-Mongo

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

When ssl was enabled for Mongo Hook, default settings included "allow insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

Fix

Related Identifiers

PYSEC-2026-278

Affected Products

Apache-Airflow-Providers-Mongo

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-25141 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-278 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/37214 · Note
• https://github.com/advisories/GHSA-x5pm-h33q-cjrw · Note
• https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm · Note
• https://pypi.org/project/apache-airflow-providers-mongo · Note
• http://openwall.com/lists/oss-security/2024/02/20/5 · Note