This vulnerability arises when the SmtpHook opens a STARTTLS session without providing an SSL context, disallowing server certificate validation. Consequently, an attacker positioned as a man‑in‑the‑middle can present a self‑signed certificate, complete the TLS handshake, and capture the SMTP credentials that Airflow subsequently sends during the login() operation.

The flaw affects the Apache Airflow Providers SMTP package distributed by the Apache Software Foundation. Any deployment of Airflow that includes versions of the SMTP provider before the fix is vulnerable. Users should upgrade to the latest apache‑airflow‑providers‑smtp release where the certificate validation issue has been addressed.

The vulnerability leads to credential theft over TLS; it requires the attacker to be able to intercept the network traffic between the Airflow worker and the SMTP server. No public exploit appears available and the EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The lack of certificate validation makes careful MITM attacks feasible. The CVSS score of 5.9 indicates medium severity, but given the potential for credential compromise, the risk warrants immediate remediation. The vulnerability is not yet listed in the CISA KEV catalog.