CVE-2026-32228

EUVD-2026-23664
UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
Affected Products (NVD)
VendorProductVersion
apacheairflow
3.0.0 ≤
𝑥
< 3.2.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/apache/airflow/pull/63338
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
http://www.openwall.com/lists/oss-security/2026/04/17/8