PUBLISHED
2026-04-18 07:16
MODIFIED
2026-04-18 07:16
EPSS (Prob. Exploit)
0.72%
Top 46.7%
> DESCRIPTION
UI / API User with asset materialize permission could trigger dags they had no access to.
Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
> GITHUB SECURITY ADVISORY
GHSA-h97w-pm3w-mwmc
HIGH
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
AFFECTED PACKAGES:
PIP / apache-airflow-core
>= 3.0.0, < 3.2.0
Fixed in: 3.2.0
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
ALIASES:
BIT-airflow-2026-32228, GHSA-h97w-pm3w-mwmc, PYSEC-2026-2360
> HISTORIQUE DES MODIFICATIONS
Première apparition
18/04/2026 07:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-863: Incorrect Authorization - The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Total des modifications: 1
Dernière mise à jour: 6 months ago