Apache Airflow's SMTP provider "SmtpHook" called Python's "smtplib.SMTP.starttls()" without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent "login()" call. Users are advised to upgrade to the "apache-airflow-providers-smtp" version that contains the fix.