CVE-2026-59245

In the Apache Airflow FAB auth manager, a DAG whose "dagid" is "DAGs" collided with the global all-DAGs permission resource name produced by "resourcename", so a user granted per-DAG "accesscontrol" on that one DAG was silently granted the global all-DAGs permission privilege escalation. The...

CVE-2026-59245: Improper Privilege Management

In the Apache Airflow FAB auth manager, a DAG whose dagid is DAGs collided with the global all-DAGs permission resource name produced by resourcename, so a user granted per-DAG accesscontrol on that one DAG was silently granted the global all-DAGs permission privilege escalation. The escalation...