CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-18 · updated 2026-10-26
Weakness: CWE-863

Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Affected products

Apache Airflow: from 3.0.0 before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: Apache Airflow 3.2.0. Check the vendor advisory for mitigations.

References

https://github.com/apache/airflow/pull/63338
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
http://www.openwall.com/lists/oss-security/2026/04/17/8

Get alerted when CVE-2026-32228 or the next vulnerability affects your stack