CVE-2026-49267: Apache Airflow EmailOperator STARTTLS Certificate Verification Bypass

Technical summary

CVE-2026-49267 addresses improper certificate verification in Apache Airflow's core email handling when smtp_starttls=True and smtp_ssl=False. The STARTTLS protocol upgrade occurs without hostname or certificate chain validation, enabling a network-positioned attacker to perform a man-in-the-middle attack. The worker completes the handshake with an attacker-controlled certificate, allowing capture of SMTP AUTH credentials and message payloads. This is the core-side equivalent of CVE-2026-41016, which separately covered the same flaw in the apache-airflow-providers-smtp package.

Business impact

Email-dependent Airflow workflows transmit database credentials, API tokens, and business-critical alerts through SMTP. Compromise of those credentials via MITM interception can lead to unauthorized access to downstream systems and data exfiltration. Organizations relying on Airflow for notification pipelines may unknowingly be exposing sensitive authentication material if their SMTP infrastructure spans untrusted network boundaries.

Affected systems

Apache Airflow versions prior to 3.2.2 are vulnerable when deployed with [email] smtp_starttls=True and [email] smtp_ssl=False. Specifically, the airflow.utils.email module and EmailOperator are affected. Deployments using smtp_ssl=True alone, or those not using STARTTLS, are unaffected. The vulnerability does not affect the separate SMTP provider package (apache-airflow-providers-smtp); however, users should verify they have applied CVE-2026-41016 patches to that provider as well.

Exploitability

Exploitation requires network positioning between the Airflow worker and SMTP server—a realistic threat in environments where the email relay is located on a separate network segment, DMZ, or cloud provider. No special credentials, authentication, or user interaction are required once the attacker is on-path. The attack is silent; the worker has no indication the certificate was invalid. CVSS score 5.9 (MEDIUM) reflects the high confidentiality impact but limited integrity risk, and the prerequisite requirement that the attacker occupy an advantageous network position (AC:H).

Remediation

Upgrade Apache Airflow to version 3.2.2 or later, which adds proper certificate verification to the STARTTLS code path. Additionally, users should audit their [email] configuration to determine whether smtp_starttls and smtp_ssl settings align with their threat model. Consider using smtp_ssl=True (direct TLS) for greater protocol security and simplicity. If STARTTLS is required, ensure the SMTP relay and workers occupy the same trusted network boundary, or deploy a VPN/mTLS tunnel to isolate the connection.

Patch guidance

Apply Apache Airflow 3.2.2 or later from the official Apache repository. Verify the patch by checking airflow.__version__ post-upgrade. If you also use apache-airflow-providers-smtp, apply the fix for CVE-2026-41016 (published 2026-04-27) to close the provider-side code path. Test the upgrade in a non-production environment to confirm email functionality and SMTP connectivity before rolling out to production workers.

Detection guidance

Monitor SMTP connection logs and TLS/SSL handshake records on your SMTP relay for unexpected certificate errors or mismatches from your Airflow worker IP addresses. Enable debug logging in Airflow's email module (set log_level to DEBUG) and inspect logs for certificate validation warnings or errors. Network-level detection via TLS certificate pinning or mutual TLS (mTLS) between worker and relay can prevent MITM attacks entirely. Correlate sudden changes in SMTP AUTH failure rates with security events or network topology changes.

Why prioritize this

This vulnerability should be prioritized for environments where SMTP relays are located outside the worker's immediate network trust zone. Organizations using Airflow to dispatch alerts, notifications, or secrets to downstream systems face elevated risk of credential theft. The CVSS score is MEDIUM but confidentiality impact is HIGH; the primary barrier to exploitation is network position, not technical complexity. Patch within your next scheduled maintenance window, or immediately if your SMTP infrastructure is internet-facing or on an untrusted network segment.

Risk score, explained

CVSS 5.9 (MEDIUM) reflects a confidentiality impact score of HIGH—exposed credentials and message content carry real risk—balanced against the requirement that an attacker be network-positioned between worker and SMTP server (AC:H, AV:N). Integrity and availability are not impacted, as the attacker observes rather than modifies traffic. The score does not account for business context; organizations using Airflow in high-value notification or data-pipeline roles should treat this as a higher operational priority despite the MEDIUM baseline.

Frequently asked questions