CVE-2026-59245 — In the Apache Airflow FAB auth manager, a DAG whose...
CVE-2026-59245 漏洞深度分析
漏洞概述
CVE 编号： CVE-2026-59245
CVSS 评分： 8.1（HIGH）
CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE 分类： CWE-269
漏洞状态： Modified
发布时间： 2026-07-13T16:16:41.880
最后更新： 2026-07-14T14:16:36.033
漏洞描述
In the Apache Airflow FAB auth manager, a DAG whose dag_id is DAGs collided with the global all-DAGs permission resource name produced by resource_name(), so a user granted per-DAG access_control on that one DAG was silently granted the global all-DAGs permission (privilege escalation). The escalation triggers when a DAG named DAGs exists and a lower-privileged user is given per-DAG access to it, granting that user read/edit access to every DAG. Users are advised to upgrade to apache-airflow-providers-fab 3.7.2 or later, which disambiguates the resource-name collision.
影响分析
此漏洞的具体影响取决于实际利用场景。"
修复建议
- 及时关注厂商发布的安全更新和补丁
- 升级受影响组件到最新版本
- 如无法立即升级，参考厂商提供的临时缓解措施
- 加强网络访问控制和监控