CVE-2026-41016: 
Python vulnerability analysis and mitigation

CVE-2026-41016 is an improper certificate validation vulnerability in the Apache Airflow SMTP provider (apache-airflow-providers-smtp) that enables man-in-the-middle (MITM) credential interception. The SmtpHook class called Python's smtplib.SMTP.starttls() without passing an SSL context, meaning no certificate validation was performed during the STARTTLS TLS upgrade. This affects apache-airflow-providers-smtp versions >= 2.0.0 and < 3.0.0 (corresponding to Apache Airflow 2.0.0 through pre-3.0.0). The vulnerability was disclosed on April 30, 2026, with a patch merged on April 16, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Feedly).

The root cause is CWE-295 (Improper Certificate Validation): Python's smtplib.SMTP.starttls() does not validate the server certificate unless an explicit SSL context is provided, and the Airflow SMTP provider's SmtpHook (both synchronous get_conn and asynchronous aget_conn) as well as airflow.utils.email.send_mime_email called starttls() without supplying one. This means the STARTTLS upgrade accepted any certificate — including self-signed ones — allowing a network-positioned attacker to complete the TLS handshake and intercept the plaintext SMTP credentials transmitted in the subsequent login() call. The fix (PR #65346) passes the existing SSL-context machinery (ssl.create_default_context() by default) to starttls() at all three call sites; environments using self-signed SMTP servers can opt out by setting ssl_context: "none" (Github Advisory, Airflow PR #65346).

A network-positioned attacker who can intercept traffic between an Airflow worker and the configured SMTP server can present a self-signed certificate, complete the STARTTLS negotiation, and capture the SMTP credentials (username and password) sent during the login() call. The impact is limited to confidentiality — integrity and availability are not affected — but stolen SMTP credentials could be leveraged for unauthorized email access, phishing campaigns, or lateral movement if the credentials are reused elsewhere (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022% (7th percentile), indicating a low near-term exploitation probability (Github Advisory). Exploitation requires a network-adjacent or on-path attacker position (high attack complexity), which further limits practical exploitability.

1. Positioning: Gain a man-in-the-middle position on the network path between an Airflow worker and its configured SMTP server — for example, via ARP spoofing, rogue Wi-Fi, or a compromised network device on the same segment.
2. Intercept SMTP connection: Capture the outbound TCP connection from the Airflow worker to the SMTP server (typically port 587 for STARTTLS).
3. Present rogue certificate: During the STARTTLS negotiation, present a self-signed or attacker-controlled TLS certificate. Because starttls() was called without an SSL context, the Airflow worker accepts any certificate without validation.
4. Complete TLS handshake: Establish the TLS session with the Airflow worker using the rogue certificate, while optionally proxying to the real SMTP server.
5. Capture credentials: Intercept the plaintext SMTP AUTH command (username and password) sent by SmtpHook.login() over the now-attacker-controlled TLS channel (Github Advisory, Airflow PR #65346).

• Network: Unexpected TLS certificate presented on port 587 (or configured SMTP port) that does not chain to a trusted CA; TLS handshake with a self-signed certificate from the SMTP server IP.
• Network: Unusual ARP traffic or duplicate ARP responses on the network segment hosting Airflow workers, potentially indicating ARP spoofing.
• Logs: Airflow worker logs showing SMTP connection errors or unexpected certificate warnings after patching (indicating prior silent acceptance of invalid certs).
• Logs: SMTP server authentication logs showing login attempts from unexpected source IPs or at unusual times, which may indicate credential reuse after interception.

Upgrade apache-airflow-providers-smtp to version 3.0.0 or later, which passes a proper SSL context to starttls() and validates SMTP server certificates against the system's trusted CAs by default. Organizations that intentionally use self-signed SMTP server certificates can preserve the previous (insecure) behavior by setting ssl_context: "none" in the SMTP connection extras (provider) or email.ssl_context = none in airflow.cfg (core). As an additional defense-in-depth measure, restrict network access between Airflow workers and SMTP servers using network segmentation or firewall rules to reduce MITM exposure (Github Advisory, Airflow PR #65346).

The vulnerability was credited to researcher francisbergin in the GitHub Advisory Database. The fix was authored by Apache Airflow maintainer Jarek Potiuk (potiuk) and reviewed by eladkal, with the PR merged on April 16, 2026, ahead of the public disclosure on April 30, 2026. No significant broader media coverage or notable social media discussion beyond standard CVE tracking feeds has been observed (Github Advisory, Airflow PR #65346).