Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL
    context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the
    Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade,
    and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade
    to the `apache-airflow-providers-smtp` version that contains the fix. (CVE-2026-41016)

ID	Name	Product	Family	Type	Severity
457811	Echo: apache-airflow-providers-smtp: security update to 3.0.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457811	Echo: apache-airflow-providers-smtp: security update to 3.0.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
442334	SCA: security update for apache-airflow-providers-smtp (GHSA-x8mh-94wc-33gv)	Tenable Cloud Security	SCA Checks	Local	medium
442334	SCA: security update for apache-airflow-providers-smtp (GHSA-x8mh-94wc-33gv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-41016

medium

Tenable Plugins

medium

medium

medium

medium