AIKIDO-2026-87035

apache-airflow-providers-fab is vulnerable to Privilege Escalation

Privilege EscalationCVE-2026-59245 Published 3 days ago

High Risk

This Affects:

apache-airflow-providers-fab

0.0.1 - 3.7.1

Fixed in 3.7.2

Are you affected? Scan for Free

TL;DR

The FAB auth manager builds permission resource names with resource_name(), which returns the raw dag_id when it matches a reserved resource name. A DAG whose dag_id is DAGs therefore collides with the global all-DAGs permission resource instead of resolving to its own per-DAG resource. Granting a lower-privileged user per-DAG access_control on that one DAG silently applies the permission to the global resource, giving that user read or edit access across every DAG. The fix disambiguates the resource-name collision so per-DAG grants no longer map onto the global resource.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the FAB auth manager with a DAG named DAGs to which lower-privileged users are granted per-DAG access control. The escalation only triggers when a DAG whose dag_id is exactly DAGs exists and such a per-DAG grant is made; deployments without that naming collision are not exposed.