PT-2026-33594 · Apache · Apache Airflow

Ahmad Abuzaid + 1 · Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-32228

NVD

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-32228

Affected Products

Apache Airflow

References · 4

• https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32228 · Security Note
• https://github.com/apache/airflow/pull/63338 · Patch
• http://openwall.com/lists/oss-security/2026/04/17/8 · Note