CVE-2026-32228
Fixed upstream EPSS <1%CVSS 7.5
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
Products: Apache Software Foundation Apache Airflow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | apache-airflow-core | 3.2.0 |