CVE-2026-32228EPSS p36.7%

CVE-2026-32228CVE-2026-32228

apache / airflow

Description

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.

Scoring

CVSS 7.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS0.43% probability of exploitation · percentile 36.7% · 2026-10-27T12:03:15Z
Last modified2026-10-26
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.