CVE-2026-32794

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

4.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N                                    

Vulnerability Description

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.

This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Vulnerability Details

Published Date

March 30, 2026

Last Modified

April 02, 2026

CWE ID

CWE-295

Source

NVD

Vendor

Apache Software Foundation

Product

Apache Airflow Provider for Databricks

External References

https://github.com/apache/airflow/pull/63704
https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb

CVE-2026-32794

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment