ByteOS Network

CVE Vulnerability Details :

CVE-2026-32228

PUBLISHED

More Info Official Page

Assigner-apache

Assigner Org ID-f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At-18 Apr, 2026 | 06:19

Updated At-18 Apr, 2026 | 06:28

▼CVE Numbering Authority (CNA)

Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Affected Products

Vendor

The Apache Software Foundation

Product

Apache Airflow

Collection URL

https://pypi.python.org

Package Name

apache-airflow

Default Status

unaffected

Versions

Affected

From 3.0.0 before 3.2.0 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-863	CWE-863: Incorrect Authorization

Type: CWE

CWE ID: CWE-863

Description: CWE-863: Incorrect Authorization

Metrics Other Info

Textual description of severity

text:

low

Credits

finder

Masamune - Unit515 OPSWAT

finder

Ahmad Abuzaid

remediation developer

Pierre Jeambrun

References

Hyperlink	Resource
https://github.com/apache/airflow/pull/63338	patch
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj	vendor-advisory

Hyperlink: https://github.com/apache/airflow/pull/63338

Resource:

patch

Hyperlink: https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.openwall.com/lists/oss-security/2026/04/17/8	N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2026/04/17/8

Resource: N/A

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References