# CVE-2026-59245: Apache Airflow FAB provider privilege escalation via DAG name collision

Source: https://junglewise.ai/threats/cve-2026-59245-apache-airflow-fab-provider-privilege-escalation-via-dag-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-59245 · Severity: info · CVSS 0 · Published 2026-07-13

Apache Airflow, a platform used to schedule and monitor workflows, contains a flaw in its FAB authentication manager. If a workflow (DAG) is specifically named 'DAGs', the system confuses it with the global permission setting for all workflows. As a result, a user who is only supposed to have access to that one specific workflow is accidentally granted full read and edit access to every workflow in the entire system.

Technologies: [Apache Software Foundation Airflow FAB Provider](https://junglewise.ai/threats/technologies/airflow-fab-provider). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation).

## Quick answers

**Is CVE-2026-59245 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59245 being exploited in the wild.

**How severe is CVE-2026-59245?** Informational severity, with a CVSS score of 0, published 13 July 2026.

**Which products and versions are affected?** Apache Software Foundation Airflow FAB Provider < 3.7.2.

**Is there a fix for CVE-2026-59245?** A patch was published on 2026-07-06: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59245 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59245?** Check whether you run Apache Software Foundation Airflow FAB Provider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in the Apache Airflow FAB auth manager due to a resource name collision in the `resource_name()` function. When a DAG is created with the ID `DAGs`, the auth manager fails to distinguish it from the global 'all-DAGs' permission resource. Consequently, granting a low-privileged user `access_control` permissions on a DAG named `DAGs` silently elevates their privileges to include global read/edit access across all DAGs in the environment. The fix, introduced in `apache-airflow-providers-fab` 3.7.2, removes a short-circuit logic that allowed bare reserved resource names to bypass the standard `DAG:<dag_id>` prefixing.

## Affected products

- Apache Software Foundation Apache Airflow FAB provider < 3.7.2

## Timeline

- 2026-06-28: disclosed: Initial pull request submitted to Apache Airflow repository
- 2026-07-06: patched: Fix merged into main branch
- 2026-07-13: advisory: CVE published by Apache Software Foundation

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/69106](https://github.com/apache/airflow/pull/69106)
- [https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h](https://lists.apache.org/thread/70f37q3mwov1vm3zolrfxlzds278c78h)

## Related threats

- [Apache Airflow FAB provider authentication bypass in Azure AD OAuth](https://junglewise.ai/threats/cve-2026-59243-apache-airflow-fab-provider-authentication-bypass-in-azure-ad)
- [Apache Airflow FAB Auth Manager LDAP filter injection](https://junglewise.ai/threats/cve-2026-46745-apache-airflow-fab-auth-manager-ldap-filter-injection)