CVE-2026-59245

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/airflow/pull/69106	Issue Tracking Patch
https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/07/13/4	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En el gestor de autenticación FAB de Apache Airflow, un DAG cuyo “dag_id” es “DAGs” colisionó con el nombre de recurso de permiso global para todos los DAGs producido por “resource_name()”, por lo que a un usuario al que se le concedió “access_control” por DAG en ese DAG específico se le concedió silenciosamente el permiso global para todos los DAGs (escalada de privilegios). La escalada se activa cuando existe un DAG llamado “DAGs” y a un usuario con privilegios inferiores se le otorga acceso por DAG a este, otorgando a ese usuario acceso de lectura/edición a cada DAG. Se aconseja a los usuarios actualizar a “apache-airflow-providers-fab” 3.7.2 o posterior, lo que desambigua la colisión de nombres de recursos.

Information

Published : 2026-07-13 16:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-59245

Mitre link : CVE-2026-59245

CVE.ORG link : CVE-2026-59245

JSON object : View

Products Affected

apache

apache-airflow-providers-fab

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-59245", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59245", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T13:37:46.335032Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow FAB provider", "versions": [{"status": "affected", "version": "0", "lessThan": "3.7.2", "versionType": "semver"}], "packageURL": "pkg:pypi/apache-airflow-providers-fab", "packageName": "apache-airflow-providers-fab", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-07-13T16:16:41.880", "references": [{"url": "https://github.com/apache/airflow/pull/69106", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/13/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision."}, {"lang": "es", "value": "En el gestor de autenticaci\u00f3n FAB de Apache Airflow, un DAG cuyo \u201cdag_id\u201d es \u201cDAGs\u201d colision\u00f3 con el nombre de recurso de permiso global para todos los DAGs producido por \u201cresource_name()\u201d, por lo que a un usuario al que se le concedi\u00f3 \u201caccess_control\u201d por DAG en ese DAG espec\u00edfico se le concedi\u00f3 silenciosamente el permiso global para todos los DAGs (escalada de privilegios). La escalada se activa cuando existe un DAG llamado \u201cDAGs\u201d y a un usuario con privilegios inferiores se le otorga acceso por DAG a este, otorgando a ese usuario acceso de lectura/edici\u00f3n a cada DAG. Se aconseja a los usuarios actualizar a \u201capache-airflow-providers-fab\u201d 3.7.2 o posterior, lo que desambigua la colisi\u00f3n de nombres de recursos."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CC9FDBF-CBF4-4FCA-A3F5-ED16ABFDEC22", "versionEndExcluding": "3.7.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}