PYSEC-2026-2360

Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

En bref

Publiée: 2026-07-13 15:02 UTC
Mise à jour: 2026-07-13 16:42 UTC
CVE: CVE-2026-32228
Alias: BIT-airflow-2026-32228, GHSA-h97w-pm3w-mwmc
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Paquets affectés

Paquet	Versions
PyPI · apache-airflow-core	introduced 3.0.0, fixed 3.2.0

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-32228 ADVISORY
https://github.com/apache/airflow/pull/63338 WEB
https://github.com/apache/airflow PACKAGE
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj WEB
http://www.openwall.com/lists/oss-security/2026/04/17/8 WEB
https://pypi.org/project/apache-airflow-core PACKAGE
https://github.com/advisories/GHSA-h97w-pm3w-mwmc ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database