Executive brief
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
Affected products
- PyPI apache-airflow-core
Junglewise Threat Intelligence
CVE-2026-32228: Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
CVE-2026-32228 · Severity: high · CVSS 7.5 · Published 2026-04-18
Technologies: apache-airflow-core (PyPI). Vendors: PyPI.