CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2026-32794
Medium (4.8) in apache airflow providers databricks. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in apache-airflow 1.12.0.
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.
This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.
Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
- CWE
- CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:airflow_providers_databricks
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wrpj-755p-x363 | PyPI | apache-airflow | >=1.10.0 <1.12.0 | 1.12.0 |
| PYSEC-2026-2357 | PyPI | apache-airflow | >=1.10.0 <1.12.0 | 1.12.0 |