{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32228", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-11T11:33:32.883Z", "datePublished": "2026-04-18T06:19:47.512Z", "dateUpdated": "2026-04-18T06:28:59.060Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow", "product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.2.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Masamune - Unit515 OPSWAT"}, {"lang": "en", "type": "finder", "value": "Ahmad Abuzaid"}, {"lang": "en", "type": "remediation developer", "value": "Pierre Jeambrun"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "UI / API User with asset materialize permission could trigger dags they had no access to.<br>Users are advised to migrate to Airflow version 3.2.0 that fixes the issue."}], "value": "UI / API User with asset materialize permission could trigger dags they had no access to.\nUsers are advised to migrate to Airflow version 3.2.0 that fixes the issue."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-18T06:19:47.512Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/63338"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to", "x_generator": {"engine": "airflow-s/generate_cve_json.py"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/17/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-18T06:28:59.060Z"}}]}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "UI / API User with asset materialize permission could trigger dags they had no access to.\nUsers are advised to migrate to Airflow version 3.2.0 that fixes the issue."}], "id": "CVE-2026-32228", "lastModified": "2026-04-18T07:16:10.560", "metrics": {}, "published": "2026-04-18T07:16:10.560", "references": [{"source": "security@apache.org", "url": "https://github.com/apache/airflow/pull/63338"}, {"source": "security@apache.org", "url": "https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/04/17/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.2.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Airflow", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "airflow", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-18T08:38:32.541593+00:00", "value": {"mitigation_remediation": ["Upgrade to Apache Airflow version 3.2.0 or later to obtain the fix that enforces proper DAG trigger authorization", "If an upgrade is not immediately feasible, revoke or limit asset materialization permissions for users who should not have the ability to trigger DAGs", "After mitigation, monitor Airflow logs for unauthorized DAG execution attempts to detect any residual or new abuse of the affected functionality"], "summary": {"action": "Apply Patch", "impact": "Unauthorized DAG execution leading to potential arbitrary code execution"}, "threat_synthesis": {"affected_systems": "All versions of Apache Airflow prior to 3.2.0 are affected. Migrating to Airflow 3.2.0 or newer removes the vulnerability by enforcing proper authorization on DAG triggers.", "description_and_impact": "A user who has permission to materialize assets can cause a DAG to run through the Airflow UI or API even if the user does not have explicit permission to run that DAG. The flaw allows the user to trigger any DAG that is available in the system, which could lead to execution of code defined in the DAG and therefore compromise the confidentiality, integrity, or availability of the environment. This is a classic missing-authorization weakness categorized as CWE-863.", "risk_and_exploitability": "The vulnerability requires an authenticated user with asset materialization rights, making it an insider or privileged\u2011user threat. No EPSS score or CVSS value is provided, and the issue is not listed in the CISA KEV catalog, but the potential impact is high because triggering a malicious DAG could provide an attacker with arbitrary code execution on the Airflow infrastructure. Exploitation would involve the user logging into the Airflow UI or making API calls to trigger the desired DAG and could be accomplished without additional privileges beyond those already granted for asset materialization."}}}}, "created": "2026-04-18T08:30:35.702684+00:00", "updated": "2026-04-18T08:45:41.378050+00:00", "vendors": ["apache", "apache$PRODUCT$airflow"]}