CVE-2026-32794mediumCWE-295

CVE-2026-32794: medium-severity vulnerability in Apache Airflow Provider for Databricks

Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange

Published · Updated

Follow this CVE+ Monitor Apache Airflow Provider for Databricks+ Monitor apache-airflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.4%
from disclosure to weaponsame day
Published on NVDMar 30
1st PoCMar 24
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache Airflow Provider for Databricks
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.