CVE-2026-32228

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@apache.org

Published

2026-04-18

Last modified

2026-10-26

Weaknesses

CWE-863

Affected products

• Airflow (Apache)
• Apache Airflow (Apache Software Foundation)

References

• https://github.com/apache/airflow/pull/63338
• https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
• http://www.openwall.com/lists/oss-security/2026/04/17/8