Apache Apache Airflow Keycloak Provider
4 CVEs affecting Apache Apache Airflow Keycloak Provider. Latest disclosed: 2026-10-15. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76187 | Critical | 9.8 | 2026-09-16 | Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak… |
CVE-2026-76186 | Critical | 9.1 | 2026-09-16 | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keyclo… |
CVE-2026-92228 | Medium | 6.5 | 2026-10-15 | The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deploymen… |
CVE-2026-96806 | Medium | 5.8 | 2026-10-15 | The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issu… |