Vulnerabilities

TI-2026-53294 CVE-2026-76187 · GHSA-rwpr-5hxh-f9cm

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

MEDIUM 51

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00977 Published 2026-09-16 Fixed in 0.10.0 CWE-287

TI-2026-53293 CVE-2026-76186 · GHSA-xhp3-rrf4-c8rv

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

MEDIUM 49

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization dec…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00811 Published 2026-09-16 Fixed in 0.10.0 CWE-565

Vulnerabilities

Filters

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity