CVE-2026-32228: Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

April 18, 2026 (updated April 22, 2026)

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

References

github.com/advisories/GHSA-h97w-pm3w-mwmc
github.com/apache/airflow/pull/63338
lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj
nvd.nist.gov/vuln/detail/CVE-2026-32228

Code Behaviors & Features

Detect and mitigate CVE-2026-32228 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →