Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-32228 · ADVISORY
• apache/airflow#63338 · WEB
• apache/airflow · PACKAGE
• lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj · WEB
• openwall.com/lists/oss-security/2026/04/17/8 · WEB
• pypi.org/project/apache-airflow-core · PACKAGE
• GitHub Advisory GHSA-h97w-pm3w-mwmc · ADVISORY

Autres vulnérabilités de apache-airflow-core

• CVE-2026-49298ÉLEVÉE 8.8A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to…
• CVE-2026-32690FAIBLE 3.7Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets s…
• CVE-2026-30912ÉLEVÉE 7.5In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lea…
• CVE-2026-25917ÉLEVÉE 7.2Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to exec…