CVE-2026-59245: CWE-269: Improper Privilege Management in Apache Software Foundation Apache Airflow FAB provider

CVE-2026-59245 is an improper privilege management vulnerability in the Apache Airflow FAB auth manager. When a DAG is named 'DAGs', its dag_id collides with the global all-DAGs permission resource name generated by resource_name(). Consequently, a user granted per-DAG access_control on this specific DAG is inadvertently granted global all-DAGs permissions, resulting in privilege escalation. This flaw allows a lower-privileged user to gain read and edit access to every DAG in the system. The issue affects apache-airflow-providers-fab versions before 3.7.2. The vendor fixed the problem in version 3.7.2 by disambiguating the resource names to prevent collision.

Users with per-DAG access to a DAG named 'DAGs' gain unintended global read and edit permissions on all DAGs, leading to privilege escalation. This compromises confidentiality and integrity of all DAGs managed by Apache Airflow FAB provider. The vulnerability does not affect availability. The CVSS score of 8.1 reflects high impact with network attack vector, low attack complexity, and no user interaction required.

Upgrade apache-airflow-providers-fab to version 3.7.2 or later, where the resource name collision is resolved. This official fix eliminates the privilege escalation risk. No other mitigations are indicated by the vendor advisory.