CVE-2026-32228

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue...

CVE-2026-32228

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-clickhouse-plug (1.6.2) +37 more potentially affected by CVE-2026-32228 via apache-airflow-core (>=3.0.0rc2, <=3.2.0rc2)

apache-airflow-core PYPI version =3.0.0rc2, =0.7.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =1.1.3rc1, =1.6.0rc1, =1.5.3rc1, =1.25.0rc1, =1.28.0 and more Source cves: CVE-2026-32228 Source advisory: MEND:CVE-2026-32228...

CVE-2026-32228

A UI or API user with asset materialize permissions can trigger DAGs they are not authorized to access in Apache Airflow . This issue specifically affects versions 3.0.0 through 3.1.x . Users are advised to migrate to Airflow version 3.2.0 to resolve this vulnerability. Exploitation details are n...