BIT-airflow-2026-32228

vendorUSosv

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

view advisory published 2026-04-21Licence: per source

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-32228US	—OT elevated	0.43% (37th)	—	2026-04-18
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2026/04/17/8ADVISORY
https://github.com/apache/airflow/pull/63338REPORT
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0njADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2026-32228WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan