Apache Airflow Providers SMTP version 2.0.0 contains an improper certificate validation vulnerability (CWE-295) in its SmtpHook implementation. The vulnerability arises because the starttls() method is called without an SSL context, which disables certificate validation during the TLS handshake. Consequently, an attacker positioned between the Airflow worker and the SMTP server can perform a man-in-the-middle attack by presenting a self-signed certificate, successfully completing the STARTTLS upgrade, and capturing SMTP credentials sent during the subsequent login call. This vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. No official patch or remediation guidance has been published by the vendor as of the provided data.

An attacker capable of intercepting network traffic between the Airflow worker and the SMTP server can exploit this vulnerability to capture SMTP credentials by presenting a fraudulent TLS certificate during the STARTTLS upgrade. This compromises the confidentiality of SMTP credentials but does not affect integrity or availability. There are no known exploits in the wild at this time.

No official patch or remediation level has been confirmed by the vendor yet. Users should monitor the Apache Software Foundation advisories for updates and upgrade to the fixed version of apache-airflow-providers-smtp once it is released. Until then, consider restricting network access between Airflow workers and SMTP servers to trusted networks to reduce the risk of man-in-the-middle attacks.