The vulnerability lies in Apache Airflow’s EmailOperator and the underlying email utilities, which establish SMTP STARTTLS connections without verifying the remote certificate when smtp_starttls is enabled but smtp_ssl is not. This is a CWE‑295 weakness (Improper Validation of Trust). This allows an attacker positioned between the Airflow worker and the SMTP relay to present a self‑signed or otherwise untrusted certificate, complete the STARTTLS handshake silently, and capture plaintext SMTP authentication credentials and any email payloads the worker forwards.

All installations of Apache Airflow prior to version 3.2.2 that use the EmailOperator with smtp_starttls=True and smtp_ssl=False are affected. The issue is confined to the core airflow package; the provider side of the same weakness is addressed by CVE-2026-41016 in the apache-airflow-providers-smtp package.

An attacker can exploit this by performing a man‑in‑the‑middle between the Airflow worker and the SMTP server, which is a typical risk when the relay resides outside the worker’s trusted network segment. The vulnerability does not carry a KEV designation, has an EPSS score below 1%, and a CVSS score of 5.9 indicating moderate severity. The potential for credential theft and message interception suggests moderate risk when the affected configuration is in use.