PT-2026-33594

CVE-2026-32228

Published

2026-04-18

Updated

2026-07-13

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 3.2.0

Description A user with asset materialize permission via the UI or API can trigger DAGs (Directed Acyclic Graphs, which are collections of all the tasks you want to run, organized in a way that reflects their relationships) to which they do not have access.

Recommendations Update to version 3.2.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Ahmad Abuzaid

Pierre Jeambrun

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization