{"affected":[{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.0.0","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"pypi","packageName":"apache-airflow-core","product":"Apache Airflow","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.2.2","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-49267","cwes":["CWE-295"],"description":"Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_starttls=True` without `[email] smtp_ssl`. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could present a self-signed certificate, have the worker complete the STARTTLS handshake silently, and capture the SMTP AUTH credentials and message contents the worker forwarded.\n\nThis CVE covers the **core apache-airflow side** of the same root cause already covered for the SMTP provider by `CVE-2026-41016` (published 2026-04-27, covering `apache-airflow-providers-smtp`). Users who already applied the SMTP-provider fix from CVE-2026-41016 should additionally upgrade `apache-airflow` to 3.2.2 or later to cover the core-side path through `airflow.utils.email`. Affects deployments configured with `smtp_starttls=True` and `smtp_ssl=False` where the SMTP relay is reachable across a less-trusted network segment than the worker.\n\nUsers are advised to upgrade to `apache-airflow` 3.2.2 or later.","epss":{"date":"2026-11-02","percentile":0.08087,"score":0.00185},"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793689068147,"publishedAt":1780300393259,"references":[{"source":"CNA: apache","tags":["patch"],"url":"https://github.com/apache/airflow/pull/65346"},{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/6v2ds757000msmjmovnnqryqzks83ps0"}],"remediation":[{"kind":"fix","source":"CNA: apache","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/apache/airflow/pull/65346"}],"revision":"b114f042d6106af6691f66173c8d3972328904db13838c9fef529c643393fb3b","sources":[{"modifiedAt":1793689068147,"name":"CNA: apache","retrievedAt":1793689765324,"url":"https://www.cve.org/CVERecord?id=CVE-2026-49267"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793689786100,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-49267"}],"ssvc":{"assessedAt":1780417250236,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache Airflow: No certificate validation on SMTP STARTTLS connections","updatedAt":1793689786100}