CVE-2026-32794: 
Apache Airflow vulnerability analysis and mitigation

CVE-2026-32794 is an Improper Certificate Validation vulnerability (CWE-295) in the Apache Airflow Provider for Databricks, where the provider code fails to validate TLS certificates during Kubernetes token exchange with the Databricks back-end. This omission exposes connections to man-in-the-middle (MitM) attacks, enabling traffic interception, manipulation, or credential exfiltration without detection. The vulnerability affects apache-airflow-providers-databricks versions 1.10.0 through 1.11.x (before 1.12.0) and was publicly disclosed on March 30, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) (Github Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-295 (Improper Certificate Validation). Specifically, the DatabricksHook in the Airflow Databricks provider used verify=False and ssl=False when making HTTP requests to the Kubernetes API server during federated token exchange, bypassing TLS certificate verification entirely. An attacker positioned on the network path between the Airflow worker and the Databricks/Kubernetes API endpoint could intercept this unverified TLS connection and perform a MitM attack. The fix, implemented in PR #63704, replaces the insecure configuration with verify=K8S_CA_CERT_PATH to enforce proper certificate validation (Airflow PR #63704, Github Advisory).

Successful exploitation allows an unauthenticated network attacker to intercept and manipulate TLS-encrypted traffic between Apache Airflow and the Databricks back-end during Kubernetes token exchange. This can result in credential exfiltration (e.g., Kubernetes service account tokens or Databricks API credentials) without any indication to the victim. There is no availability impact, but both confidentiality and integrity are partially compromised, and stolen credentials could enable further lateral movement into Databricks workspaces or Kubernetes clusters (Github Advisory, Openwall OSS-Sec).

The primary remediation is to upgrade apache-airflow-providers-databricks to version 1.12.0 or later, which enforces TLS certificate verification for Kubernetes API server connections during token exchange (Github Advisory, Airflow PR #63704). For environments unable to upgrade immediately, network-level controls should be implemented to restrict and monitor traffic between Airflow workers and Databricks/Kubernetes endpoints, reducing the opportunity for MitM interception. Monitoring for unexpected or anomalous outbound connections from Airflow workers is also recommended as a compensating control (Feedly).

The vulnerability was reported by Kai Aizen and remediated by Marcin Wojtyczka, with the fix merged into the Apache Airflow main branch on March 17, 2026, prior to public disclosure on March 30, 2026. The Apache security team disclosed the issue via the oss-security mailing list and classified its severity as "low," consistent with the CVSS Medium score. Community reaction was limited, with brief mentions on Bluesky and standard aggregation by vulnerability tracking services (Openwall OSS-Sec, Github Advisory).