oss-security - CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <c485a7ad-e053-59d8-c6f3-72ff6c404979@apache.org>
Date: Fri, 17 Apr 2026 10:31:25 +0000
From: Rahul Vats <rahulvats@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-32228: Apache Airflow: Users with asset materialization
 permisssions could trigger Dags they had no access to 

Severity: low 

Affected versions:

- Apache Airflow (apache-airflow) 3.0.0 before 3.2.0

Description:

UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Credit:

Masamune - Unit515 OPSWAT (finder)
Ahmad Abuzaid (finder)
Pierre Jeambrun (remediation developer)

References:

https://github.com/apache/airflow/pull/63338
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-32228

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.