Threats affecting pkg:pypi/apache-airflow-provider-databricks

CVE-2026-32794 is an improper certificate validation vulnerability in the Apache Airflow Provider for Databricks versions from 1.10.0 before 1.12.0. The provider did not validate certificates for connections to the Databricks back-end, which could allow a man-in-the-middle attacker to intercept or manipulate traffic or exfiltrate credentials without detection. The issue is fixed in version 1.12.0. The vulnerability has a CVSS score of 4.