Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-32228

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Airflow

Default version status: unaffected

  • 3.0.0 to < 3.2.0affected

References