CVE-2026-32794 Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange
Attackers can intercept traffic and steal credentials via man-in-the-middle attacks due to disabled TLS certificate verification in the Databricks provider.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32794?
CVE-2026-32794 is a medium-severity vulnerability in Apache Airflow Provider for Databricks, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.
This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.
Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Weakness: CWE-295
Which versions are affected by CVE-2026-32794?
3 open source packages ship an affected version, including apache-airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | From 1.10.0 | 1.12.0 |
apache-airflow PyPI | From 1.10.0 | 1.12.0 |
apache-airflow PyPI | From 1.10.0 | 1.12.0 |
Products include Apache Airflow Providers Databricks.
How do I fix CVE-2026-32794?
Upgrade apache-airflow to 1.12.0 or later.
Is CVE-2026-32794 being exploited?
There is no known exploitation of CVE-2026-32794 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-wrpj-755p-x363, PYSEC-2026-2357.