CVE-2026-76186

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

EUVD-2026-80324

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-76187

CVE-2026-76187 affects the Apache Airflow Keycloak provider (apache-airflow-providers-keycloak). The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. Because no allowlist res...

CVE-2026-76186

CVE-2026-76186 affects the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) in Airflow 3.3 and later . The root cause is that Keycloak access and refresh tokens are read from unauthenticated cookies and never validated against the subject in the signed Airflow session toke...