TI-2026-29599 Aliases CVE-2026-40948 GHSA-5w6h-pjw6-wvc6

Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

LOW 25CWE-352Published 2026-04-18 · Updated 2026-04-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00404 34th percentileScored 2026-11-07

Fix Fixed Apache Airflow Providers Keycloak (Apache Software Foundation): 0.7.0apache-airflow-providers-keycloak (PyPI): 0.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Airflow Providers Keycloak	0.0.1 to before 0.7.0	0.7.0	Patch available	CNA
—	apache-airflow-providers-keycloak (PyPI)	0.0.1 to before 0.7.0	0.7.0	Patch available	GHSA-5w6h-pjw6-wvc6

Apache Airflow Providers Keycloak VendorApache Affected 0.0.1 to before 0.7.0 Fixed in 0.7.0 Patch available CNA
apache-airflow-providers-keycloak (PyPI) Vendor— Affected 0.0.1 to before 0.7.0 Fixed in 0.7.0 Patch available GHSA-5w6h-pjw6-wvc6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:apache-airflow-providers-keycloak::::::::	0.0.1 to before 0.7.0	Vulnerable	Apache

cpe:2.3:a:apache:apache-airflow-providers-keycloak:*:*:*:*:*:*:*:* Versions 0.0.1 to before 0.7.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache Airflow Providers Keycloak (Apache Software Foundation) Fixed in 0.7.0
Fix · GHSA-5w6h-pjw6-wvc6 apache-airflow-providers-keycloak (PyPI) Fixed in 0.7.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-40948
2026-10-03 Alias added: GHSA-5w6h-pjw6-wvc6

References

Patch 1

https://github.com/apache/airflow/pull/64114

Advisory 3

Other 1

https://github.com/apache/airflow

TI-2026-53294 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT CVSS 3.1CRITICAL 9.8
TI-2026-53293 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences