Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-32228

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

VectorNETWORK

PublishedApr 18, 2026, 07:16

Published Bysecurity@apache.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

apache-airflow-core(PyPI)3.0.03.2.0N/A

References

https://github.com/apache/airflow/pull/63338
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
http://www.openwall.com/lists/oss-security/2026/04/17/8

Weakness Type

CWE-863

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK