CVE-2026-32228

CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

Vendor Apache Software Foundation

Product Apache Airflow

Weakness CWE-863 · Incorrect authorization

Published April 18, 2026

Last update April 20, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Key dates

02Disclosure timeline

April 18, 2026 CVE published

April 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-32228 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html AskarLabs — CWE-863 write-up Incorrect Authorization

Related vulnerabilities

04Related CVE

CVE-2025-3609 Reales WP STPT <= 2.1.2 - Unauthorized User Registration CVE-2026-13238 Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058 CVE-2025-14866 Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment CVE-2025-3880 Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update CVE-2025-13985 Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123