As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-96806 affects the Apache Airflow Keycloak provider before version 0.11.1. The Keycloak auth manager fails to properly terminate sessions on logout because KeycloakJWTMiddleware issues a new, unrevoked token even after the logout route revokes the presented token, leaving users logged in. Deployments using the Keycloak auth manager require the patch to prevent unauthorized access after logout.
Why it matters: Organizations running Apache Airflow with Keycloak authentication are exposed to session hijacking: users remain logged in after logout, allowing attackers with network access to impersonate them and access Airflow workflows and data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session (JWTMiddleware mints an unrevoked replacement token)
CVE-2026-96806 affects the Apache Airflow Keycloak provider before version 0.11.1. The Keycloak auth manager fails to properly terminate sessions on logout because KeycloakJWTMiddleware issues a new, unrevoked token even after the logout route revokes the presented token, leaving users logged in. Deployments using the Keycloak auth manager require the patch to prevent unauthorized access after logout.
Why it matters: Organizations running Apache Airflow with Keycloak authentication are exposed to session hijacking: users remain logged in after logout, allowing attackers with network access to impersonate them and access Airflow workflows and data.
- Source published
- First seen by Cybersecurity Tracker