As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
CVE-2026-76187 affects Apache Airflow Keycloak provider versions before 0.10.0, allowing any confidential client registered in a Keycloak realm to mint Airflow session JWTs through the unauthenticated token endpoint. The absence of an allowlist means credentials from unrelated clients can authenticate without restriction. The vulnerability carries moderate severity.
Why it matters: Organizations using Airflow with Keycloak provider versions prior to 0.10.0 face unauthorized session hijacking risk if any client credential within the realm is compromised; upgrade to version 0.10.0 or later immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider before version 0.10.0 allows any confidential client registered in a Keycloak realm to mint Airflow session tokens via the unauthenticated token endpoint, since the provider fails to restrict which client credentials can authenticate. This flaw enables privilege escalation and unauthorized access to Airflow instances that rely on Keycloak for authentication.
Why it matters: Organizations using Apache Airflow with the Keycloak provider are at risk of session hijacking and lateral movement if attackers obtain credentials from any registered confidential client in the realm; immediate patching to version 0.10.0 or later is required.
- Source published
- First seen by Cybersecurity Tracker