Skip to content
fr Sign in
Not rated

CVE-2026-59245 In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission…

Description

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.

Affected products and versions

Product Affected versions Fixed in
Apache Airflow Fab Provider 3.7 earliest → < 3.7.2 3.7.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Airflow Fab Provider

The 9 CVEs of Apache Airflow Fab Provider →
CVE-2026-86466 Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience… Not rated CVE-2026-82310 Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation Not rated CVE-2026-86462 Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate… Not rated CVE-2026-82311 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed… Not rated
Track this CVE