CVE-2026-49267 is an improper certificate validation vulnerability (CWE-295) in Apache Airflow's core email functionality. When Airflow is configured with smtp_starttls=True and smtp_ssl=False, the EmailOperator and airflow.utils.email helpers establish SMTP STARTTLS connections without verifying the remote server's TLS certificate. This allows a man-in-the-middle attacker on the network path between the Airflow worker and the SMTP server to present a self-signed certificate, causing the worker to complete the TLS handshake silently and expose SMTP authentication credentials and email content. This vulnerability affects Airflow versions starting from 2.0.0 and is fixed in version 3.2.2. It complements a related fix in the SMTP provider package (CVE-2026-41016).

An attacker capable of intercepting network traffic between the Airflow worker and the SMTP server can exploit this vulnerability to capture SMTP authentication credentials and email message contents. This compromises the confidentiality of email communications sent by Airflow and potentially allows unauthorized access to the SMTP server. The vulnerability only affects deployments using STARTTLS without SSL where the SMTP relay is reachable across a less-trusted network segment than the worker.

Users should upgrade Apache Airflow to version 3.2.2 or later to address this vulnerability. If the related SMTP provider package fix (CVE-2026-41016) has already been applied, upgrading Airflow itself is still necessary to cover the core-side email path. There is no indication that temporary mitigations or workarounds are sufficient. Patch status is not explicitly stated but the vendor advises upgrading to 3.2.2 or later, indicating an official fix is available in that version.