EUVD-2026-80762

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92133

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

EUVD-2026-80008

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via uploadmarkdown enables PAT exfiltration and full account takeover...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration due to the Core API accepting existing, unexpired tokens for accounts that have been deactivated by an...

Incorrect Authorization

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Incorrect Authorization in the unauthenticated token endpoint, which accepts a client-credentials grant for any confidential...

CVE-2026-86466

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-82310

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-76186

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

CVE-2026-76187

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

EUVD-2026-80324

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-76187

The apache-airflow-providers-keycloak package is vulnerable to incorrect authorization in its unauthenticated token endpoint. The root cause is the lack of an allowlist, which allows the endpoint to accept a client-credentials grant for any confidential client registered in a shared Keycloak real...

CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

CVE-2026-76186

The apache-airflow-providers-keycloak package (specifically in Airflow 3.3 and later) is vulnerable to a logic flaw where the Keycloak auth manager fails to validate that the Keycloak access and refresh tokens (provided via separate, unauthenticated cookies) belong to the same subject as the sign...

EUVD-2026-80323

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

EUVD-2026-80322

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82310

The apache-airflow-providers-fab package is vulnerable to insufficient session expiration when used with Airflow 3 and the FAB auth manager with Core API token authentication. The root cause is that while password authentication correctly rejects disabled accounts, the Core API continues to accep...