CVE-2026-59245 PUBLISHED

Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

Assigner: apache
Reserved: 04.07.2026 Published: 13.07.2026 Updated: 13.07.2026

In the Apache Airflow FAB auth manager, a DAG whose dag_id is DAGs collided with the global all-DAGs permission resource name produced by resource_name(), so a user granted per-DAG access_control on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named DAGs exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to apache-airflow-providers-fab 3.7.2 or later, which disambiguates the resource-name collision.

Product Status

Vendor Apache Software Foundation
Product Apache Airflow FAB provider
Versions Default: unaffected
  • affected from 0 to 3.7.2 (excl.)

Credits

  • Tran Hieu (h1tr3xnull) finder
  • Jarek Potiuk remediation developer

References

Problem Types

  • CWE-269: Improper Privilege Management CWE