CVE-2026-41016: Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider
Apache Airflow's SMTP provider SmtpHook called Python's smtplib.SMTP.starttls() without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent login() call. Users are advised to upgrade to the apache-airflow-providers-smtp version that contains the fix.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41016?
CVE-2026-41016 is considered a moderate severity vulnerability due to the risks of man-in-the-middle attacks.
How do I fix CVE-2026-41016?
To fix CVE-2026-41016, implement SSL context for certificate validation in the SMTP provider's SmtpHook when using starttls().
Which versions of Apache Airflow Providers SMTP are affected by CVE-2026-41016?
CVE-2026-41016 affects the versions of the Apache Airflow Providers SMTP where the SmtpHook does not validate certificates during starttls().
Can CVE-2026-41016 be exploited remotely?
Yes, CVE-2026-41016 can be exploited remotely through untrusted network connections that may intercept and alter SMTP traffic.
Is there a workaround for CVE-2026-41016 before applying a patch?
A recommended workaround for CVE-2026-41016 is to use a trusted connection without relying on STARTTLS until a patch is available.