CVE-2026-49267 Apache Airflow: No certificate validation on SMTP STARTTLS connections
Attackers can intercept SMTP credentials and emails via MITM due to missing certificate validation in Airflow's STARTTLS connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49267?
CVE-2026-49267 is a medium-severity vulnerability in Apache Airflow, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Airflow's EmailOperator and the underlying `airflow.utils.email` helpers established SMTP STARTTLS connections without verifying the remote certificate when the deployment used `[email] smtp_starttls=True` without `[email] smtp_ssl`. An attacker positioned between the worker and the configured SMTP server (network MITM — typical hostile-network attack-surface for environments where the SMTP relay sits outside the worker's trust boundary) could present a self-signed certificate, have the worker complete the STARTTLS handshake silently, and capture the SMTP AUTH credentials and message contents the worker forwarded.
This CVE covers the **core apache-airflow side** of the same root cause already covered for the SMTP provider by `CVE-2026-41016` (published 2026-04-27, covering `apache-airflow-providers-smtp`). Users who already applied the SMTP-provider fix from CVE-2026-41016 should additionally upgrade `apache-airflow` to 3.2.2 or later to cover the core-side path through `airflow.utils.email`. Affects deployments configured with `smtp_starttls=True` and `smtp_ssl=False` where the SMTP relay is reachable across a less-trusted network segment than the worker.
Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
Weakness: CWE-295
Which versions are affected by CVE-2026-49267?
4 open source packages ship an affected version, including apache-airflow and airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow PyPI | From 2.0.0 | 3.2.2 |
apache-airflow PyPI | From 2.0.0 | 3.2.2 |
apache-airflow PyPI | From 2.0.0 | 3.2.2 |
airflow Bitnami | From 2.0.0 | 3.2.2 |
Products include Apache Airflow.
How do I fix CVE-2026-49267?
Upgrade apache-airflow to 3.2.2 or later.
Is CVE-2026-49267 being exploited?
There is no known exploitation of CVE-2026-49267 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow
- CVE-2020-13927 Apache Airflow's Experimental API Authentication Bypass
- CVE-2020-11978 Apache Airflow Command Injection
- CVE-2026-33264 Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2023-25754 Apache Airflow: Privilege escalation using airflow logs
- CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow
Sources
Also known as BIT-airflow-2026-49267, ECHO-b79a-0540-f5c0, GHSA-799x-qp47-8qwq, MINI-662r-jq93-25m5, MINI-r4xw-ww9f-f63j, PYSEC-2026-2346.