---
id: CVE-2026-32228
aliases:
  - GHSA-h97w-pm3w-mwmc
  - BIT-airflow-2026-32228
  - PYSEC-2026-2360
title: >-
  Apache Airflow allows users with asset materialize permissions to trigger DAGs
  outside of their permissions
summary: >-
  Apache Airflow allows users with asset materialize permissions to trigger DAGs
  outside of their permissions
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: apache-airflow-core
product: apache-airflow-core
ecosystem: pip
affected:
  - 'apache-airflow-core >= 3.0.0, < 3.2.0'
patched:
  - apache-airflow-core 3.2.0
published: '2026-04-18'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h97w-pm3w-mwmc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32228'
  - url: 'https://github.com/apache/airflow/pull/63338'
  - url: 'https://github.com/apache/airflow'
  - url: 'https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj'
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/17/8'
tags:
  - osv
  - pip
epss: 0.00426
epssPercentile: 0.36512
ingestedAt: '2026-07-13T18:57:59.058Z'
---

## Overview

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

## Affected packages

- `apache-airflow-core >= 3.0.0, < 3.2.0`

## Remediation

Upgrade to a patched release:

- `apache-airflow-core 3.2.0`