CVE-2026-59245 Privilege escalation in Apache Airflow FAB provider
A DAG named 'DAGs' causes a resource name collision, granting users per-DAG access global permissions to all DAGs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59245?
CVE-2026-59245 is a high-severity vulnerability in Apache Airflow FAB provider, published on 13 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.
Weakness: CWE-269
Which versions are affected by CVE-2026-59245?
It affects 1 product.
Products include Apache Apache-Airflow-Providers-Fab.
How do I fix CVE-2026-59245?
Upgrade to a fixed version.
Is CVE-2026-59245 being exploited?
There is no known exploitation of CVE-2026-59245 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow FAB provider
- CVE-2026-82311 Security feature bypass in Apache Airflow FAB provider
- CVE-2026-59243 Auth bypass in Apache Airflow FAB provider
- CVE-2024-42447 Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow
- CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
- CVE-2026-75156 Auth bypass in Apache Airflow FAB provider
Sources
Also known as CLEANSTART-2026-KM66532, GHSA-fx25-85xr-cgxm.