{"id":"CVE-2026-32794","summary":"Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange","details":"Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.\n\nThis issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which fixes the issue.","aliases":["GHSA-wrpj-755p-x363","PYSEC-2026-2357"],"modified":"2026-07-13T16:43:04.551142757Z","published":"2026-03-30T21:43:38.144Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32794.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/03/30/9"},{"type":"WEB","url":"https://pypi.python.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32794.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32794"},{"type":"FIX","url":"https://github.com/apache/airflow/pull/63704"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/airflow","events":[{"introduced":"b0057c29de1676435501f7af49143a8d008c7daa"},{"fixed":"a1ddf31098a8388d392b338ed29e8925b0e77b69"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:apache:airflow_providers_databricks:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.10.0"},{"fixed":"1.12.0"}]}}],"versions":["airflow-ctl/0.1.2rc1","airflow-ctl/0.1.2","providers/2026-02-20","providers-elasticsearch/6.5.0rc1","providers-common-sql/1.32.0rc1","helm-chart/1.19.0rc3","helm-chart/1.19.0","providers/2026-02-10","providers-ydb/2.4.0rc1","providers-ydb/2.4.0","providers-yandex/4.4.0rc1","providers-yandex/4.4.0","providers-teradata/3.4.3rc1","providers-teradata/3.4.3","providers-tableau/5.3.3rc1","providers-tableau/5.3.3","providers-standard/1.11.1rc1","providers-standard/1.11.1","providers-snowflake/6.9.1rc1","providers-snowflake/6.9.1","providers-postgres/6.5.4rc1","providers-postgres/6.5.4","providers-oracle/4.4.0rc1","providers-oracle/4.4.0","providers-openlineage/2.10.2rc1","providers-openlineage/2.10.2","providers-mysql/6.4.3rc1","providers-mysql/6.4.3","providers-microsoft-azure/13.0.0rc1","providers-keycloak/0.5.2rc1","providers-keycloak/0.5.2","providers-imap/3.11.0rc1","providers-imap/3.11.0","providers-hashicorp/4.5.0rc1","providers-hashicorp/4.5.0","providers-google/20.0.0rc1","providers-github/2.11.0rc1","providers-github/2.11.0","providers-git/0.2.3rc1","providers-git/0.2.3","providers-fab/3.3.0rc1","providers-fab/3.3.0","providers-exasol/4.9.3rc1","providers-exasol/4.9.3","providers-edge3/3.0.2rc1","providers-edge3/3.0.2","providers-databricks/7.9.1rc1","providers-databricks/7.9.1","providers-common-sql/1.31.0rc1","providers-common-sql/1.31.0","providers-common-compat/1.13.1rc1","providers-common-compat/1.13.1","providers-cncf-kubernetes/10.12.4rc1","providers-cncf-kubernetes/10.12.4","providers-celery/3.16.0rc1","providers-celery/3.16.0","providers-apache-kafka/1.12.0rc1","providers-apache-kafka/1.12.0","providers-apache-hive/9.2.5rc1","providers-apache-hive/9.2.5","providers-apache-cassandra/3.9.2rc1","providers-apache-cassandra/3.9.2","providers-amazon/9.22.0rc1","helm-chart/1.19.0rc2","helm-chart/1.19.0rc1","providers/2026-01-27","providers-yandex/4.3.3rc1","providers-yandex/4.3.3","providers-teradata/3.4.2rc1","providers-teradata/3.4.2","providers-standard/1.11.0rc1","providers-standard/1.11.0","providers-ssh/4.3.1rc1","providers-ssh/4.3.1","providers-snowflake/6.9.0rc1","providers-snowflake/6.9.0","providers-sftp/5.7.0rc1","providers-sftp/5.7.0","providers-postgres/6.5.3rc1","providers-postgres/6.5.3","providers-pagerduty/5.2.3rc1","providers-pagerduty/5.2.3","providers-opensearch/1.8.4rc1","providers-opensearch/1.8.4","providers-openlineage/2.10.1rc1","providers-openlineage/2.10.1","providers-mysql/6.4.2rc1","providers-mysql/6.4.2","providers-microsoft-azure/12.10.3rc1","providers-microsoft-azure/12.10.3","providers-keycloak/0.5.1rc1","providers-keycloak/0.5.1","providers-http/5.6.4rc1","providers-http/5.6.4","providers-hashicorp/4.4.3rc1","providers-hashicorp/4.4.3","providers-google/19.5.0rc1","providers-google/19.5.0","providers-git/0.2.2rc1","providers-git/0.2.2","providers-fab/3.2.0rc1","providers-fab/3.2.0","providers-exasol/4.9.2rc1","providers-exasol/4.9.2","providers-elasticsearch/6.4.4rc1","providers-elasticsearch/6.4.4","providers-edge3/3.0.1rc1","providers-edge3/3.0.1","providers-dbt-cloud/4.6.4rc1","providers-dbt-cloud/4.6.4","providers-databricks/7.9.0rc1","providers-databricks/7.9.0","providers-common-sql/1.30.4rc1","providers-common-sql/1.30.4","providers-common-compat/1.13.0rc1","providers-common-compat/1.13.0","providers-cohere/1.6.2rc1","providers-cohere/1.6.2","providers-cncf-kubernetes/10.12.3rc1","providers-cncf-kubernetes/10.12.3","providers-celery/3.15.2rc1","providers-celery/3.15.2","providers-apache-livy/4.5.3rc1","providers-apache-livy/4.5.3","providers-apache-hive/9.2.4rc1","providers-apache-hive/9.2.4","providers-apache-hdfs/4.11.3rc1","providers-apache-hdfs/4.11.3","providers-amazon/9.21.0rc1","providers-amazon/9.21.0","providers-alibaba/3.3.4rc1","providers-alibaba/3.3.4","providers/2026-01-17","providers-google/19.4.0rc2","providers-google/19.4.0","providers-cncf-kubernetes/10.12.2rc2","providers-cncf-kubernetes/10.12.2","providers/2026-01-13","providers-zendesk/4.11.1rc1","providers-zendesk/4.11.1","providers-ydb/2.3.2rc1","providers-ydb/2.3.2","providers-yandex/4.3.2rc1","providers-yandex/4.3.2","providers-weaviate/3.3.1rc1","providers-weaviate/3.3.1","providers-vertica/4.2.1rc1","providers-vertica/4.2.1","providers-trino/6.4.2rc1","providers-trino/6.4.2","providers-teradata/3.4.1rc1","providers-teradata/3.4.1","providers-telegram/4.9.2rc1","providers-telegram/4.9.2","providers-tableau/5.3.2rc1","providers-tableau/5.3.2","providers-standard/1.10.3rc1","providers-standard/1.10.3","providers-ssh/4.3.0rc1","providers-ssh/4.3.0","providers-sqlite/4.2.1rc1","providers-sqlite/4.2.1","providers-snowflake/6.8.2rc1","providers-snowflake/6.8.2","providers-smtp/2.4.2rc1","providers-smtp/2.4.2","providers-slack/9.6.2rc1","providers-slack/9.6.2","providers-singularity/3.9.2rc1","providers-singularity/3.9.2","providers-sftp/5.6.0rc1","providers-sftp/5.6.0","providers-sendgrid/4.2.1rc1","providers-sendgrid/4.2.1","providers-segment/3.9.2rc1","providers-segment/3.9.2","providers-samba/4.12.2rc1","providers-samba/4.12.2","providers-salesforce/5.12.2rc1","providers-salesforce/5.12.2","providers-redis/4.4.2rc1","providers-redis/4.4.2","providers-qdrant/1.5.2rc1","providers-qdrant/1.5.2","providers-presto/5.10.3rc1","providers-presto/5.10.3","providers-postgres/6.5.2rc1","providers-postgres/6.5.2","providers-pinecone/2.4.2rc1","providers-pinecone/2.4.2","providers-pgvector/1.6.1rc1","providers-pgvector/1.6.1","providers-papermill/3.12.1rc1","providers-papermill/3.12.1","providers-pagerduty/5.2.2rc1","providers-pagerduty/5.2.2","providers-oracle/4.3.1rc1","providers-oracle/4.3.1","providers-opsgenie/5.10.1rc1","providers-opsgenie/5.10.1","providers-opensearch/1.8.3rc1","providers-opensearch/1.8.3","providers-openlineage/2.10.0rc1","providers-openlineage/2.10.0","providers-openfaas/3.9.2rc1","providers-openfaas/3.9.2","providers-openai/1.7.2rc1","providers-openai/1.7.2","providers-odbc/4.11.1rc1","providers-odbc/4.11.1","providers-neo4j/3.11.3rc1","providers-neo4j/3.11.3","providers-mysql/6.4.1rc1","providers-mysql/6.4.1","providers-mongo/5.3.2rc1","providers-mongo/5.3.2","providers-microsoft-winrm/3.13.3rc1","providers-microsoft-winrm/3.13.3","providers-microsoft-psrp/3.2.3rc1","providers-microsoft-psrp/3.2.3","providers-microsoft-mssql/4.4.1rc1","providers-microsoft-mssql/4.4.1","providers-microsoft-azure/12.10.2rc1","providers-microsoft-azure/12.10.2","providers-keycloak/0.5.0rc1","providers-keycloak/0.5.0","providers-jenkins/4.2.2rc1","providers-jenkins/4.2.2","providers-jdbc/5.3.2rc1","providers-jdbc/5.3.2","providers-influxdb/2.10.2rc1","providers-influxdb/2.10.2","providers-imap/3.10.3rc1","providers-imap/3.10.3","providers-http/5.6.3rc1","providers-http/5.6.3","providers-hashicorp/4.4.2rc1","providers-hashicorp/4.4.2","providers-grpc/3.9.2rc1","providers-grpc/3.9.2","providers-google/19.4.0rc1","providers-github/2.10.2rc1","providers-github/2.10.2","providers-git/0.2.1rc1","providers-git/0.2.1","providers-ftp/3.14.1rc1","providers-ftp/3.14.1","providers-facebook/3.9.2rc1","providers-facebook/3.9.2","providers-fab/3.1.2rc1","providers-fab/3.1.2","providers-exasol/4.9.1rc1","providers-exasol/4.9.1","providers-elasticsearch/6.4.3rc1","providers-elasticsearch/6.4.3","providers-edge3/3.0.0rc1","providers-edge3/3.0.0","providers-docker/4.5.2rc1","providers-docker/4.5.2","providers-discord/3.12.0rc1","providers-discord/3.12.0","providers-dingding/3.9.2rc1","providers-dingding/3.9.2","providers-dbt-cloud/4.6.3rc1","providers-dbt-cloud/4.6.3","providers-datadog/3.10.2rc1","providers-datadog/3.10.2","providers-databricks/7.8.3rc1","providers-databricks/7.8.3","providers-common-sql/1.30.3rc1","providers-common-sql/1.30.3","providers-common-messaging/2.0.2rc1","providers-common-messaging/2.0.2","providers-common-io/1.7.1rc1","providers-common-io/1.7.1","providers-common-compat/1.12.0rc1","providers-common-compat/1.12.0","providers-cohere/1.6.1rc1","providers-cohere/1.6.1","providers-cncf-kubernetes/10.12.1rc1","providers-cncf-kubernetes/10.12.1","providers-cloudant/4.3.2rc1","providers-cloudant/4.3.2","providers-celery/3.15.1rc1","providers-celery/3.15.1","providers-atlassian-jira/3.3.1rc1","providers-atlassian-jira/3.3.1","providers-asana/2.11.1rc1","providers-asana/2.11.1","providers-arangodb/2.9.2rc1","providers-arangodb/2.9.2","providers-apprise/2.3.1rc1","providers-apprise/2.3.1","providers-apache-tinkerpop/1.1.1rc1","providers-apache-tinkerpop/1.1.1","providers-apache-spark/5.5.0rc1","providers-apache-spark/5.5.0","providers-apache-pinot/4.9.2rc1","providers-apache-pinot/4.9.2","providers-apache-pig/4.8.2rc1","providers-apache-pig/4.8.2","providers-apache-livy/4.5.2rc1","providers-apache-livy/4.5.2","providers-apache-kylin/3.10.2rc1","providers-apache-kylin/3.10.2","providers-apache-kafka/1.11.3rc1","providers-apache-kafka/1.11.3","providers-apache-impala/1.8.1rc1","providers-apache-impala/1.8.1","providers-apache-iceberg/1.4.1rc1","providers-apache-iceberg/1.4.1","providers-apache-hive/9.2.3rc1","providers-apache-hive/9.2.3","providers-apache-hdfs/4.11.2rc1","providers-apache-hdfs/4.11.2","providers-apache-flink/1.8.2rc1","providers-apache-flink/1.8.2","providers-apache-druid/4.4.2rc1","providers-apache-druid/4.4.2","providers-apache-drill/3.2.1rc1","providers-apache-drill/3.2.1","providers-apache-cassandra/3.9.1rc1","providers-apache-cassandra/3.9.1","providers-apache-beam/6.2.2rc1","providers-apache-beam/6.2.2","providers-amazon/9.20.0rc1","providers-amazon/9.20.0","providers-alibaba/3.3.3rc1","providers-alibaba/3.3.3","providers-airbyte/5.3.2rc1","providers-airbyte/5.3.2","airflow-ctl/0.1.1rc1","airflow-ctl/0.1.1","providers/2025-12-30","providers-yandex/4.3.1rc1","providers-yandex/4.3.1","providers-teradata/3.4.0rc1","providers-teradata/3.4.0","providers-standard/1.10.2rc1","providers-standard/1.10.2","providers-snowflake/6.8.1rc1","providers-snowflake/6.8.1","providers-qdrant/1.5.1rc1","providers-qdrant/1.5.1","providers-presto/5.10.2rc1","providers-presto/5.10.2","providers-pinecone/2.4.1rc1","providers-pinecone/2.4.1","providers-opensearch/1.8.2rc1","providers-opensearch/1.8.2","providers-openlineage/2.9.2rc1","providers-openlineage/2.9.2","providers-neo4j/3.11.2rc1","providers-neo4j/3.11.2","providers-mongo/5.3.1rc1","providers-mongo/5.3.1","providers-microsoft-winrm/3.13.2rc1","providers-microsoft-winrm/3.13.2","providers-microsoft-psrp/3.2.2rc1","providers-microsoft-psrp/3.2.2","providers-microsoft-azure/12.10.1rc1","providers-microsoft-azure/12.10.1","providers-keycloak/0.4.1rc1","providers-keycloak/0.4.1","providers-influxdb/2.10.1rc1","providers-influxdb/2.10.1","providers-imap/3.10.2rc1","providers-imap/3.10.2","providers-http/5.6.2rc1","providers-http/5.6.2","providers-hashicorp/4.4.1rc1","providers-hashicorp/4.4.1","providers-grpc/3.9.1rc1","providers-grpc/3.9.1","providers-google/19.3.0rc1","providers-google/19.3.0","providers-git/0.2.0rc1","providers-git/0.2.0","providers-fab/3.1.1rc1","providers-fab/3.1.1","providers-elasticsearch/6.4.2rc1","providers-elasticsearch/6.4.2","providers-edge3/2.0.1rc1","providers-edge3/2.0.1","providers-dbt-cloud/4.6.2rc1","providers-dbt-cloud/4.6.2","providers-databricks/7.8.2rc1","providers-databricks/7.8.2","providers-common-sql/1.30.2rc1","providers-common-sql/1.30.2","providers-common-compat/1.11.0rc1","providers-common-compat/1.11.0","providers-cncf-kubernetes/10.12.0rc1","providers-cncf-kubernetes/10.12.0","providers-celery/3.15.0rc1","providers-celery/3.15.0","providers-apache-spark/5.4.2rc1","providers-apache-spark/5.4.2","providers-apache-kafka/1.11.2rc1","providers-apache-kafka/1.11.2","providers-apache-hive/9.2.2rc1","providers-apache-hive/9.2.2","providers-amazon/9.19.0rc1","providers-amazon/9.19.0","providers-alibaba/3.3.2rc1","providers-alibaba/3.3.2","providers/2025-12-09","providers-ydb/2.3.1rc1","providers-ydb/2.3.1","providers-trino/6.4.1rc1","providers-trino/6.4.1","providers-teradata/3.3.1rc1","providers-teradata/3.3.1","providers-telegram/4.9.1rc1","providers-telegram/4.9.1","providers-tableau/5.3.1rc1","providers-tableau/5.3.1","providers-standard/1.10.1rc1","providers-standard/1.10.1","providers-ssh/4.2.1rc1","providers-ssh/4.2.1","providers-snowflake/6.8.0rc1","providers-snowflake/6.8.0","providers-smtp/2.4.1rc1","providers-smtp/2.4.1","providers-slack/9.6.1rc1","providers-slack/9.6.1","providers-singularity/3.9.1rc1","providers-singularity/3.9.1","providers-sftp/5.5.1rc1","providers-sftp/5.5.1","providers-segment/3.9.1rc1","providers-segment/3.9.1","providers-samba/4.12.1rc1","providers-samba/4.12.1","providers-salesforce/5.12.1rc1","providers-salesforce/5.12.1","providers-redis/4.4.1rc1","providers-redis/4.4.1","providers-presto/5.10.1rc1","providers-presto/5.10.1","providers-postgres/6.5.1rc1","providers-postgres/6.5.1","providers-pagerduty/5.2.1rc1","providers-pagerduty/5.2.1","providers-opensearch/1.8.1rc1","providers-opensearch/1.8.1","providers-openlineage/2.9.1rc1","providers-openlineage/2.9.1","providers-openfaas/3.9.1rc1","providers-openfaas/3.9.1","providers-openai/1.7.1rc1","providers-openai/1.7.1","providers-neo4j/3.11.1rc1","providers-neo4j/3.11.1","providers-microsoft-winrm/3.13.1rc1","providers-microsoft-winrm/3.13.1","providers-microsoft-psrp/3.2.1rc1","providers-microsoft-psrp/3.2.1","providers-microsoft-azure/12.10.0rc1","providers-microsoft-azure/12.10.0","providers-keycloak/0.4.0rc1","providers-keycloak/0.4.0","providers-jenkins/4.2.1rc1","providers-jenkins/4.2.1","providers-jdbc/5.3.1rc1","providers-jdbc/5.3.1","providers-imap/3.10.1rc1","providers-imap/3.10.1","providers-http/5.6.1rc1","providers-http/5.6.1","providers-google/19.2.0rc1","providers-google/19.2.0","providers-github/2.10.1rc1","providers-github/2.10.1","providers-git/0.1.1rc1","providers-git/0.1.1","providers-facebook/3.9.1rc1","providers-facebook/3.9.1","providers-fab/3.1.0rc1","providers-fab/3.1.0","providers-elasticsearch/6.4.1rc1","providers-elasticsearch/6.4.1","providers-edge3/2.0.0rc1","providers-edge3/2.0.0","providers-docker/4.5.1rc1","providers-docker/4.5.1","providers-discord/3.11.1rc1","providers-discord/3.11.1","providers-dingding/3.9.1rc1","providers-dingding/3.9.1","providers-dbt-cloud/4.6.1rc1","providers-dbt-cloud/4.6.1","providers-datadog/3.10.1rc1","providers-datadog/3.10.1","providers-databricks/7.8.1rc1","providers-databricks/7.8.1","providers-common-sql/1.30.1rc1","providers-common-sql/1.30.1","providers-common-compat/1.10.1rc1","providers-common-compat/1.10.1","providers-cncf-kubernetes/10.11.1rc1","providers-cncf-kubernetes/10.11.1","providers-cloudant/4.3.1rc1","providers-cloudant/4.3.1","providers-celery/3.14.1rc1","providers-celery/3.14.1","providers-arangodb/2.9.1rc1","providers-arangodb/2.9.1","providers-apache-spark/5.4.1rc1","providers-apache-spark/5.4.1","providers-apache-pinot/4.9.1rc1","providers-apache-pinot/4.9.1","providers-apache-pig/4.8.1rc1","providers-apache-pig/4.8.1","providers-apache-livy/4.5.1rc1","providers-apache-livy/4.5.1","providers-apache-kylin/3.10.1rc1","providers-apache-kylin/3.10.1","providers-apache-kafka/1.11.1rc1","providers-apache-kafka/1.11.1","providers-apache-hive/9.2.1rc1","providers-apache-hive/9.2.1","providers-apache-hdfs/4.11.1rc1","providers-apache-hdfs/4.11.1","providers-apache-flink/1.8.1rc1","providers-apache-flink/1.8.1","providers-apache-druid/4.4.1rc1","providers-apache-druid/4.4.1","providers-apache-beam/6.2.1rc1","providers-apache-beam/6.2.1","providers-amazon/9.18.1rc1","providers-amazon/9.18.1","providers-alibaba/3.3.1rc1","providers-alibaba/3.3.1","providers-airbyte/5.3.1rc1","providers-airbyte/5.3.1","providers/2025-12-01","providers-standard/1.10.0rc2","providers-standard/1.10.0","providers-ssh/4.2.0rc2","providers-ssh/4.2.0","providers-slack/9.6.0rc2","providers-slack/9.6.0","providers-microsoft-azure/12.9.0rc2","providers-microsoft-azure/12.9.0","providers-google/19.1.0rc2","providers-google/19.1.0","providers-edge3/1.6.0rc2","providers-edge3/1.6.0","providers-docker/4.5.0rc2","providers-docker/4.5.0","providers-common-sql/1.30.0rc2","providers-common-sql/1.30.0","providers-cncf-kubernetes/10.11.0rc2","providers-cncf-kubernetes/10.11.0","providers-celery/3.14.0rc2","providers-celery/3.14.0","providers-amazon/9.18.0rc2","providers-amazon/9.18.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32794.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}