점검 대응높음KEV 미등록
CVE-2026-59245
Apache Software Foundation Apache Airflow FAB provider, apache-airflow-providers-fab 취약점
In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission resource name produced by `resource_name()`, so a user granted per-DAG `access_control` on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named `DAGs` exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to `apache-airflow-providers-fab` 3.7.2 or later, which disambiguates the resource-name collision.
- 대응 우선순위
- 점검
- CVSS
- 8.1
- EPSS
- 0.36% 백분위 28.2% · 2026.07.15 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.14