Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32228US | —OT elevated | — | ||
UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue. | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/04/17/8WEB
- https://github.com/advisories/GHSA-h97w-pm3w-mwmcADVISORY
- https://github.com/apache/airflowPACKAGE
- https://github.com/apache/airflow/pull/63338WEB
- https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0njWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32228ADVISORY
- https://pypi.org/project/apache-airflow-corePACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan