CVE-2026-76186

CVE-2026-76186 affects the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) in Airflow 3.3 and later . The root cause is that Keycloak access and refresh tokens are read from unauthenticated cookies and never validated against the subject in the signed Airflow session toke...

EUVD-2026-42025

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with...