CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflow-coreto a version that resolves this vulnerability.Fixed in 3.2.0 - Upgrade
Upgrade
Apache Airflowto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32228?
CVE-2026-32228 is categorized as a moderate severity vulnerability.
How do I fix CVE-2026-32228?
To fix CVE-2026-32228, users should upgrade to Apache Airflow version 3.2.0 or later.
What impact does CVE-2026-32228 have on Apache Airflow users?
CVE-2026-32228 allows users with asset materialization permissions to trigger DAGs they should not have access to, potentially leading to unauthorized actions.
Which versions of Apache Airflow are affected by CVE-2026-32228?
Versions of Apache Airflow from 3.0.0 up to, but not including, 3.2.0 are affected by CVE-2026-32228.
Are there any recommended practices to prevent CVE-2026-32228?
It is recommended to regularly update to the latest version of Apache Airflow and review user permissions to mitigate risks associated with CVE-2026-32228.