CVE-2026-59245
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In Apache Airflow FAB auth manager, a DAG named `DAGs` collides with the global all-DAGs permission resource name. A user granted per-DAG access to that specific DAG silently receives global all-DAGs permissions, leading to privilege escalation.
Risk Assessment
The organization is at risk of unauthorized access to all DAGs by a low-privileged user who only has per-DAG access to a DAG named `DAGs`. This could result in data leakage or workflow manipulation.
Recommendation
Immediately upgrade `apache-airflow-providers-fab` to version 3.7.2 or later, which resolves the resource name collision.
Other vulnerabilities in Apache Airflow FAB auth manager
Original NVD description (English source)
In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.