CVE-2026-32228: 
Python vulnerability analysis and mitigation

CVE-2026-32228 is an incorrect authorization vulnerability in Apache Airflow that allows authenticated users with asset materialize permission to trigger DAGs (Directed Acyclic Graphs) they are not authorized to access. It affects Apache Airflow versions 3.0.0 through versions prior to 3.2.0 (specifically the apache-airflow-core pip package). The vulnerability was discovered by Masamune of Unit515 OPSWAT and Ahmad Abuzaid, with remediation developed by Pierre Jeambrun. It was publicly disclosed on April 17–18, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Openwall OSS-Sec).

The root cause is CWE-863 (Incorrect Authorization): the asset materialization endpoint in Airflow's UI and REST API failed to enforce a secondary permission check verifying whether the requesting user had the can trigger dag run privilege for the target DAG. A user with only the asset materialize permission could exploit this gap by invoking the materialization endpoint, which internally triggered DAG runs without validating DAG-level access controls. The fix, merged in pull request #63338, adds an explicit can trigger dag run permission check within the asset materialization handler (GitHub PR, Github Advisory).

Successful exploitation allows an authenticated but insufficiently privileged user to trigger execution of arbitrary DAGs outside their authorization scope. This can result in unauthorized workflow execution, unintended data processing, consumption of compute resources, and potential execution of sensitive or privileged operations embedded in those DAGs. While confidentiality impact is rated High (due to potential access to data processed by unauthorized DAGs), there is no direct integrity or availability impact scored for this vulnerability (Github Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires authentication — an attacker must already hold an account with asset materialize permission on the target Airflow instance. The EPSS score is approximately 0.015% (0.000150), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Qualys (ID: 5011422) and Nessus (ID: 315213) (Github Advisory, Openwall OSS-Sec).

1. Reconnaissance: Identify Apache Airflow instances running versions 3.0.0 through 3.1.x. This can be done by checking the Airflow version endpoint (/api/v1/version) or reviewing deployment manifests.
2. Obtain credentials: Acquire valid credentials for an Airflow account that has been granted the asset materialize permission but lacks DAG trigger permissions for specific DAGs.
3. Identify target DAGs: Browse the Airflow UI or query the REST API to enumerate DAGs that the account cannot normally trigger (e.g., GET /api/v1/dags).
4. Invoke the asset materialization endpoint: Send a crafted API or UI request to the asset materialization endpoint, referencing an asset linked to the target DAG. Because the endpoint did not check can trigger dag run permissions, the DAG run is initiated without authorization.
5. Confirm unauthorized DAG execution: Observe the DAG run appearing in the Airflow UI or via GET /api/v1/dag_runs/{dag_id}, confirming that the restricted DAG was triggered (GitHub PR, Github Advisory).

• Logs: Airflow scheduler and webserver logs showing DAG runs initiated by users who do not have explicit DAG trigger permissions; audit log entries associating asset materialization events with DAG runs for DAGs outside the user's normal access scope.
• Application Behavior: Unexpected DAG runs appearing in the Airflow UI triggered by accounts with only asset materialize roles; DAG run records with run_type of asset_triggered for DAGs the triggering user should not have access to.
• Network: Unusual API calls to the asset materialization endpoint (e.g., POST /api/v2/assets/materialize or equivalent) from user accounts not typically associated with DAG management activity.

The primary remediation is to upgrade Apache Airflow to version 3.2.0 or later, which includes the additional permission check in the asset materialization endpoint (Github Advisory, GitHub PR). Until patching is feasible, administrators should audit and restrict asset materialize permissions to only highly trusted users, and consider implementing network-level access controls to limit exposure of the Airflow UI and API. Monitoring DAG execution logs for unexpected trigger patterns from users with materialize permissions is also recommended as a compensating control.

The vulnerability was discussed on the oss-security mailing list upon disclosure and received coverage from automated vulnerability tracking services and security aggregators. Social media posts on Bluesky and Mastodon noted the advisory shortly after publication. No major vendor statements beyond the Apache Airflow project's own advisory and patch were identified, and community reaction was measured given the requirement for prior authentication to exploit the flaw (Openwall OSS-Sec).