CVE-2026-32228

published 2026-04-18

CVE-2026-32228: UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	airflow	>= 3.0.0 < 3.2.0	3.2.0
apache_software_foundation	apache_airflow	>= 3.0.0 < 3.2.0	3.2.0

CWE-863