CVE-2026-41016

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-smtp (affected versions not specified)

Description The SmtpHook component in the SMTP provider calls the Python function smtplib.SMTP.starttls() without an SSL context. This omission prevents certificate validation during the TLS upgrade. Consequently, a man-in-the-middle attacker positioned between the Airflow worker and the SMTP server could present a self-signed certificate to complete the STARTTLS upgrade and capture SMTP credentials transmitted during the login() call.

Recommendations Upgrade to the version of apache-airflow-providers-smtp that contains the fix.