CVE-2026-32794

mediumPriorität · verfolgen · 10EPSS 0.004 · 33. PerzentilExploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.39% (33rd) EPSS

CVSS 4.8 · medium

Is it mine?

5 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · bewertet 2026-10-27

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

4.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NsecondaryAusnutzbarkeit 2.2 · Auswirkung 2.5

v3.14.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV

v3.14.6mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-295USCWE-295US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

SnailSploit/CVE-2026-32794CVE-2026-32794: TLS Certificate Verification Bypass in Apache Airflow Databricks ProviderPoC · poc_in_github

betroffene Produkte (5)

Betroffene Produkte und Versionsbereiche.

Apache Airflow Provider for Databricks <1.12.0alle Versionencert_bundDE
Apache Airflow≤ Provider for Databricks <1.12.0cert_bundDE
Apache Software Foundation Apache Airflow Provider for Databricks1.10.0 → 1.12.0enisa_euvdEU
apache airflow providers databricks1.10.0 → 1.12.0nvdUScpe:2.3:a:apache:airflow_providers_databricks:*:*:*:*:*:*:*:*
PyPI apache-airflow1.10.0 → 1.12.0osvUSpkg:pypi/apache-airflow

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-0916Apache Airflow: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-03-30csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Apache Airflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-wrpj-755p-x363Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange2026-03-31ghsa · osvUS
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.
PYSEC-2026-2357Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange2026-07-13vendor · osvUS
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

veröffentlicht 2026-03-30geändert 2026-06-17

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

https://access.redhat.com/security/cve/cve-2026-32794 cnnvd
https://github.com/apache/airflow/pull/63704 cnnvd
https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb cnnvd
https://github.com/apache/airflow/pull/63704 enisa_euvd
https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb enisa_euvd
http://www.openwall.com/lists/oss-security/2026/03/30/9Mailing ListThird Party Advisorynvd
https://github.com/apache/airflow/pull/63704Issue TrackingPatchnvd
https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nbMailing ListVendor Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan