CVE-2026-32228

EUVD-2026-23664
UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apacheairflow
3.0.0 ≤
𝑥
< 3.2.0
CNA
Common Weakness Enumeration
References
https://github.com/apache/airflow/pull/63338
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
http://www.openwall.com/lists/oss-security/2026/04/17/8