PT-2026-57821 · Apache · Apache Airflow Fab Provider

Jarek Potiuk + 1 · Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-59245

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.7.2

Description In the Apache Airflow FAB auth manager, a privilege escalation occurs when a DAG is created with a dag id of DAGs. This specific ID collides with the global all-DAGs permission resource name generated by the resource name() function. Consequently, a lower-privileged user granted per-DAG access control for that specific DAG is silently granted global permissions, allowing them read and edit access to every DAG in the system.

Recommendations Upgrade to apache-airflow-providers-fab 3.7.2 or later.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-59245

Affected Products

Apache Airflow Fab Provider

References · 7

• https://github.com/apache/airflow/pull/69106 · Patch
• https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59245 · Security Note
• https://twitter.com/infoflowcloud/status/2076723592650268917 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2076732021326463018 · Twitter Post
• http://openwall.com/lists/oss-security/2026/07/13/4 · Note
• https://twitter.com/CVEnew/status/2076722745203724512 · Twitter Post