CVE-2026-59245

Katalog CVE

CVSS 8.1 · High EPSS 0,60%

Kerentanan Improper Privilege Management pada apache-airflow-providers-fab. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.

Rincian

Terbit di NVD

13 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h mailing list · advisory vendor
• https://github.com/apache/airflow/pull/69106 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/07/13/4 mailing list · advisory pihak ketiga