18 matches found
EUVD-2026-102520
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-92228
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-96806
The Apache Airflow Keycloak auth manager is vulnerable to a session management flaw where the logout route fails to terminate the user session. Although the logout route revokes the presented token, the KeycloakJWTMiddleware component issues a new, unrevoked token within the same response, effect...
CVE-2026-96806
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but "KeycloakJWTMiddleware" then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected:...
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-92228
The apache-airflow-providers-keycloak component is vulnerable due to an issue in the multi-team provisioning function (_attach_team_permissions). This flaw incorrectly grants every team role global read access to audit logs. Affected deployments are those that enable multi-team mode with the Keyc...
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-76186
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
CVE-2026-76187
The apache-airflow-providers-keycloak package is vulnerable to incorrect authorization in its unauthenticated token endpoint. The root cause is the lack of an allowlist, which allows the endpoint to accept a client-credentials grant for any confidential client registered in a shared Keycloak real...
CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
EUVD-2026-80324
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
CVE-2026-76187
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
CVE-2026-76186
The apache-airflow-providers-keycloak package (specifically in Airflow 3.3 and later) is vulnerable to a logic flaw where the Keycloak auth manager fails to validate that the Keycloak access and refresh tokens (provided via separate, unauthenticated cookies) belong to the same subject as the sign...
CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
PT-2026-93413
Name of the Vulnerable Software and Affected Versions Apache Airflow Keycloak provider versions 3.3 and later Description The Keycloak auth manager retrieves a user's identity from a signed Airflow session token but obtains Keycloak access and refresh tokens from separate, unauthenticated cookies...
CVE-2026-76187: Improper Authentication
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...