Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice. This issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32794: Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange https://www.openwall.com/lists/oss-security/2026/03/30/9
Post summary
The message announces CVE‑2026‑32794, a TLS certificate verification flaw in the Apache Airflow provider for Databricks, providing a technical detail but lacking PoC, exploit, or patch information.
CVE-2026-32794 Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks bac… https://www.cve.org/CVERecord?id=CVE-2026-32794
Post summary
The tweet announces CVE‑2026‑32794, describing an improper certificate validation issue in the Apache Airflow Provider for Databricks, but it lacks any proof‑of‑concept, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | airflow_providers_databricks | - | - | - |