Advisories · Technology

Apache Software Foundation Apache Airflow Keycloak provider.

Every CVE that names Apache Software Foundation Apache Airflow Keycloak provider among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-96806 CVE record

CVSS 5.8 Medium

Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
- Apache Software Foundation Apache Airflow Keycloak provider
- Authentication bypass
Not analysed yet 15 Oct 2026
CVE-2026-92228 CVE record

CVSS 6.5 Medium

Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
- Apache Software Foundation Apache Airflow Keycloak provider
- Broken access control
Not analysed yet 15 Oct 2026
CVE-2026-76187 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
- Apache Software Foundation Apache Airflow Keycloak provider
- Authentication bypass
Not analysed yet 16 Sept 2026
CVE-2026-76186 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
- Apache Software Foundation Apache Airflow Keycloak provider
- CWE-565
Not analysed yet 16 Sept 2026