Improper certificate validation in the Databricks provider for Apache Airflow allows an attacker to perform a man‑in‑the‑middle attack. By bypassing TLS verification, the attacker can intercept, modify or eavesdrop on traffic between Airflow and Databricks, potentially exfiltrating credentials and altering job submissions. The weakness is classified as CWE‑295, an insecure design in which encryption is not validated.

Apache Airflow Provider for Databricks, released by the Apache Software Foundation, is affected in versions starting from 1.10.0 up to but excluding 1.12.0. The provider facilitates connections between Airflow DAGs and Databricks workspaces; the vulnerability specifically lies in the token exchange used when the provider runs on Kubernetes, where TLS certificate verification is disabled. Users deploying these versions should check if they are within this range.

With a CVSS base score of 4.8, the vulnerability is considered moderate. The EPSS score of less than 1% indicates low public exploitation probability, and the issue is not listed in the CISA KEV catalog. Nevertheless, because the vulnerability stems from unverified certificates, an attacker positioned to observe the network path could carry out a silent MITM operation. The attack vector is inferred to be remote over the network between Airflow and Databricks, requiring no local vulnerabilities but relying on insecure certificate handling.