{"schema_version": "1.6.1", "id": "CVE-2026-32794", "summary": "TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange", "details": "Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o notice.\n\nThis issue affects Apache Airflow Provider for Databricks: from 1.10.0 before 1.12.0.\n\nUsers are recommended to upgrade to version 1.12.0, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "1.10.0"}, {"fixed": "1.12.0"}]}]}], "references": [{"type": "WEB", "url": "https://github.com/apache/airflow/pull/63704"}, {"type": "WEB", "url": "https://lists.apache.org/thread/hn17yqsgsdtl81llvhf80rkp53hnz5nb"}]}