5.9

CVE-2026-41016: apache software foundation apache airflow providers smtp Improper Certificate Validation

CVSS: 5.9v3.1MediumAnalyzed
AliasesGHSA-x8mh-94wc-33gvPYSEC-2026-24CGA-93qj-98qg-7wwg
Published 30-04-2026Last modified 30-04-2026
Open JSON

Vulnerability summary

CVE-2026-41016 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in apache software foundation apache airflow providers smtp. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.7% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.27%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-7PFP-9CHV-RWHH

Timeline

  1. 30-04-2026
    PublishedVulnerability first disclosed.
  2. 30-04-2026
    Last modifiedVulnerability information updated.

Description

Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

0.00 pp

From 0.27% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • airflow-2All versions (No fix recorded)
  • airflow-3< 3.2.1-r4
  • airflow-core-2< 2.11.2-r6
Apache1 product
Apache software foundation1 product
PyPI1 product
  • apache-airflow-providers-smtp≥ 2.0.0, < 3.0.0
Wolfi1 product
  • airflow-3< 3.2.1-r4

5 vendors · 7 products

References

8 links