CVE-2026-41016

Apache Airflow's SMTP provider "SmtpHook" called Python's "smtplib.SMTP.starttls" without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTL...