CVE-2026-32228 — Vulnerability intelligence
apache — airflow
Published:
- CVSS
- 7.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.