HIGH7.5

PYSEC-2026-2360

Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions

Quick fix

PYSEC-2026-2360 — apache-airflow-core: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow-core>=3.2.0'

Details

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow-core

Introduced in: 3.0.0Fixed in: 3.2.0

Fixpip install --upgrade 'apache-airflow-core>=3.2.0'

References

https://nvd.nist.gov/vuln/detail/CVE-2026-32228[ADVISORY]
https://github.com/apache/airflow/pull/63338[WEB]
https://github.com/apache/airflow[PACKAGE]
https://lists.apache.org/thread/s7c75txgt4qf2rofcn43szfwgcrzy0nj[WEB]
http://www.openwall.com/lists/oss-security/2026/04/17/8[WEB]
https://pypi.org/project/apache-airflow-core[PACKAGE]
https://github.com/advisories/GHSA-h97w-pm3w-mwmc[ADVISORY]