GHSA-h97w-pm3w-mwmc
Apache Airflow allows users with asset materialize permissions to trigger DAGs outside of their permissions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | apache-airflow-core | >= 3.0.0, < 3.2.0 | 3.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate to Airflow version 3.2.0 that fixes the issue.
References
External links from the advisory. They lead to third-party sites.