CVE-2026-32228CWE-863

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

High · published April 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

UI / API User with asset materialize permission could trigger dags they had no access to.

Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00716 · 53.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-18T06:19Z
EPSS history
Timeline
  • 18 APR 06:19Z
    Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
    cvelistv5