PyPI: apache-airflow-core
CVE-2026-32228
Safety vulnerability ID: SFTY-20260418-51195
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
Overview
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Advisory
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
How to Fix
Upgradeapache-airflow-coreto3.2.0or higher.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260418-51195/CVE-2026-32228
- https://nvd.nist.gov/vuln/detail/CVE-2026-32228
- https://github.com/apache/airflow/pull/63338
- https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
- http://www.openwall.com/lists/oss-security/2026/04/17/8
- https://github.com/advisories/GHSA-h97w-pm3w-mwmc
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more