CVE-2026-32228: UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.

Quick answers

Is CVE-2026-32228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32228 being exploited in the wild.

How severe is CVE-2026-32228?

High severity, with a CVSS score of 7.5, published 18 April 2026.

Which products and versions are affected?

apache-airflow-core (PyPI) >= 3.0.0, < 3.2.0, ECOSYSTEM:introduced=3.0.0,fixed=3.2.0.

Is there a fix for CVE-2026-32228?

Yes. apache-airflow-core (PyPI): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-32228?

Check whether you run Apache Airflow or apache-airflow-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• apache-airflow-core (PyPI): upgrade to 3.2.0 or later

  pip install "apache-airflow-core>=3.2.0"

Affected products

• Apache Airflow
• apache-airflow-core (PyPI) >= 3.0.0, < 3.2.0, ECOSYSTEM:introduced=3.0.0,fixed=3.2.0

Identifiers

• CVE-2026-32228
• GHSA-h97w-pm3w-mwmc
• PYSEC-2026-2360

References

• https://github.com/apache/airflow/pull/63338
• https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
• http://www.openwall.com/lists/oss-security/2026/04/17/8