---
id: CVE-2026-32794
aliases:
  - GHSA-wrpj-755p-x363
  - PYSEC-2026-2357
title: >-
  Apache Airflow Provider for Databricks: TLS Certificate Verification is
  Disabled in Databricks Provider K8s Token Exchange
summary: >-
  Apache Airflow Provider for Databricks: TLS Certificate Verification is
  Disabled in Databricks Provider K8s Token Exchange
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
vendor: apache-airflow
product: apache-airflow
ecosystem: pip
affected:
  - 'apache-airflow >= 1.10.0, < 1.12.0'
patched:
  - apache-airflow 1.12.0
published: '2026-03-31'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wrpj-755p-x363'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32794'
  - url: 'https://github.com/apache/airflow/pull/63704'
  - url: 'https://github.com/apache/airflow'
  - url: 'https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb'
  - url: 'http://www.openwall.com/lists/oss-security/2026/03/30/9'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00429
epssPercentile: 0.34446
ingestedAt: '2026-07-13T18:58:04.709Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/SnailSploit/CVE-2026-32794'
  checkedAt: '2026-09-25T08:20:54.983Z'
exploitAvailable: true
---

## Overview

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.

This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

## Affected packages

- `apache-airflow >= 1.10.0, < 1.12.0`

## Remediation

Upgrade to a patched release:

- `apache-airflow 1.12.0`