Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

HIGH 7.5CVE-2026-32228 · BIT-airflow-2026-32228 · GHSA-h97w-pm3w-mwmc · Published 18/04/2026 · updated 26/10/2026

In short

CVE-2026-32228 is a HIGH (CVSS 7.5) vulnerability affecting apache-airflow-core, airflow (apache).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 36.9% of all vulnerabilities.
Fix: update to 3.2.0 or later.

Package	Affected versions	Patched versions
apache-airflow-core PyPI	`≥ 3.0.0, < 3.2.0`	`3.2.0`
airflow apache	`≥ 3.0.0, < 3.2.0`	`3.2.0`

Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

NVD description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2026-32228 · ADVISORY
apache/airflow#63338 · WEB
apache/airflow · PACKAGE
lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj · WEB
openwall.com/lists/oss-security/2026/04/17/8 · WEB
pypi.org/project/apache-airflow-core · PACKAGE
GitHub Advisory GHSA-h97w-pm3w-mwmc · ADVISORY

More vulnerabilities in apache-airflow-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow-core

PyPI

≥ 3.0.0, < 3.2.0

3.2.0

airflow

apache

≥ 3.0.0, < 3.2.0

3.2.0

Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

NVD description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

More vulnerabilities in apache-airflow-core

See all →