Apache Apache-Airflow-Providers-Keycloak
3 CVEs affecting Apache Apache-Airflow-Providers-Keycloak. Latest disclosed: 2026-09-16. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76187 | Critical | 9.8 | 2026-09-16 | Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak… |
CVE-2026-76186 | Critical | 9.1 | 2026-09-16 | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keyclo… |
CVE-2026-40948 | Medium | 5.4 | 2026-04-18 | The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-ca… |