CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

EUVD-2026-80322

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

EUVD-2026-80321

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-86792

The apache-airflow-providers-apache-kafka package (versions 1.15.0 before 2.0.0) is vulnerable to arbitrary code execution on the scheduler due to unsafe reflection. The root cause is the import_string function, which resolves dotted-path strings from a Kafka connection's extra field into Python ...

CVE-2026-86792 Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

EUVD-2026-80320

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-86462 Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-86465 Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...

CVE-2026-86465 Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to ...

ROOT-APP-MAVEN-CVE-2026-41003 CVE-2026-41003 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-41003 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40988 CVE-2026-40988 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-40988 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40993 CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root

Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available...

EUVD-2026-80069

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

PT-2026-93403

CVE-2026-97636 - Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key CVE ID :CVE-2026-97636 Published : Sept. 24, 2026, 10:17 p.m. | 1 hour, 6 minutes ago Description :Apache Airflow HashiCorp provider: the HashiCorp Vault secrets...

CVE-2026-86792: Use of Externally-Controlled Input to Select Classes or Code

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...