CVE-2026-49267 describes an improper certificate validation vulnerability (CWE-295) in Apache Airflow's EmailOperator and underlying airflow.utils.email helpers. When configured with smtp_starttls=True and smtp_ssl=False, the SMTP STARTTLS connection does not verify the remote SMTP server's certificate. This allows an attacker positioned between the Airflow worker and the SMTP server to perform a man-in-the-middle attack by presenting a self-signed certificate. The worker completes the STARTTLS handshake without validation, exposing SMTP AUTH credentials and message contents. This vulnerability affects the core Apache Airflow component and complements a related vulnerability in the apache-airflow-providers-smtp package (CVE-2026-41016). The issue is fixed in Apache Airflow 3.2.2 and later.

An attacker able to intercept network traffic between the Airflow worker and the SMTP server can present a fraudulent certificate during the STARTTLS handshake. Because the certificate is not validated, the attacker can decrypt SMTP authentication credentials and email message contents sent by the worker. This compromises confidentiality of email data and credentials, potentially allowing further unauthorized access or data leakage. The vulnerability requires a network man-in-the-middle position and affects deployments where the SMTP relay is outside the worker's trust boundary and configured with smtp_starttls=True and smtp_ssl=False.

Users should upgrade Apache Airflow to version 3.2.2 or later, which addresses this improper certificate validation issue in the core airflow.utils.email code path. Additionally, users who have applied the fix for the related SMTP provider vulnerability (CVE-2026-41016) should ensure their core Airflow version is also updated to 3.2.2 or later. There is no indication that temporary workarounds or configuration changes fully mitigate this issue without upgrading. Patch status is not explicitly confirmed in the advisory, but the vendor recommends upgrading to 3.2.2 or later as the remediation.