An oversight in the Apache Airflow Provider for Databricks caused the provider to skip TLS certificate validation when connecting to Databricks services. This omission creates a CWE‑295 weakness that allows an attacker to tamper with data or leak credentials without the user’s awareness.

Vulnerable versions of the provider run from 1.10.0 up to, but not including, 1.12.0. Any deployment using those releases is affected; upgrading to 1.12.0 or later resolves the flaw.

The CVSS score is 4.8, indicating moderate severity, while the EPSS score is under 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the fact that certificate validation is omitted, is an attacker positioned between Airflow and Databricks—such as a malicious actor on an untrusted network—who could present a forged certificate and intercept traffic. This inference is drawn from the description and is not explicitly stated in the advisory.