CVE-2026-32794: Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange

[Jens Scheffler <jscheffl () apache org>]

Severity: low 

Affected versions:

- Apache Airflow Provider for Databricks (apache-airflow-providers-databricks) 1.10.0 before 1.12.0

Description:

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate 
certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is 
intercepted and manipulated or credentials exfiltrated w/o notice.

This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.

Users are recommended to upgrade to version 1.12.0, which fixes the issue.

Credit:

Kai Aizen (reporter)
Marcin Wojtyczka (remediation developer)

References:

https://github.com/apache/airflow/pull/63704
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-32794