Apache Airflow Provider for Databricks Improper Certificate Validation Vulnerability

A vulnerability exists in Apache Airflow Provider for Databricks versions 1.10.0 prior to 1.12.0, due to improper validation of TLS certificates for connections to the Databricks back-end. This flaw could allow a man-in-the-middle attack, where an attacker intercepts and manipulates traffic or exfiltrates credentials without detection.

Impact

Exploitation of this vulnerability could lead to a man-in-the-middle attack, allowing interception and manipulation of traffic or unauthorized exfiltration of credentials.

Remediation

Users are advised to upgrade to Apache Airflow Provider for Databricks version 1.12.0, which addresses this vulnerability.