3405 matches found
CVE-2026-76187
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...
CVE-2026-86465
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...
CVE-2026-86466
Apache Airflow FAB provider (apache-airflow-providers-fab) contains an authentication bypass in the Authentik OAuth path of its FAB auth manager. The issuer and audience claims of the accepted id_token are not validated, allowing an attacker who holds a valid token minted by the same Authentik id...
EUVD-2026-80327
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...
EUVD-2026-80324
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...
CVE-2026-76187
Apache Airflow Keycloak provider contains a critical authentication flaw in its unauthenticated token endpoint. The endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not just the one configured for Airflow. Because no allowlist restricts val...
EUVD-2026-80323
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
CVE-2026-76186
Apache Airflow Keycloak provider (v0.10.0 and earlier, used with Airflow 3.3+) contains a privilege escalation flaw: the Keycloak auth manager reads user identity from the signed Airflow session token but pulls the Keycloak access/refresh tokens from separate unauthenticated cookies , never verif...
CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
EUVD-2026-80322
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...
CVE-2026-82310
Apache Airflow FAB provider (Airflow 3 with the FAB auth manager and Core API token authentication) has a flaw where deactivating a user does not revoke previously issued JWT tokens . An administrator's deactivation of an account silently fails to contain access: the Core API continues to accept ...
CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...
CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...
EUVD-2026-80321
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...
CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...
CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...
CVE-2026-86792
Apache Airflow Apache Kafka provider (versions 1.15.0 through before 2.0.0) contains an arbitrary code execution flaw in the Kafka event producer code path. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist and handed to...