EUVD-2026-80324

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-76187

Apache Airflow Keycloak provider contains a critical authentication flaw in its unauthenticated token endpoint. The endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not just the one configured for Airflow. Because no allowlist restricts val...

CVE-2026-76186

Apache Airflow Keycloak provider (v0.10.0 and earlier, used with Airflow 3.3+) contains a privilege escalation flaw: the Keycloak auth manager reads user identity from the signed Airflow session token but pulls the Keycloak access/refresh tokens from separate unauthenticated cookies , never verif...

PYSEC-2026-2369 apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2026-40948

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: opa-envoy, rancher-system-agent, db-operator, scorecard, gitea, grpc-health-probe, steampipe, kargo, nri-haproxy, petname, kuberlr, rabbitmq-cluster-operator, newrelic-nri-kube-events, kpt, kube-logging-operator-custom-runner, kubernetes-csi-external-health-monitor,...