As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
CVE-2026-76186 affects the Apache Airflow Keycloak provider before version 0.10.0, where Keycloak access and refresh tokens are stored in unauthenticated cookies rather than bound to the Airflow session token. This separation creates a security gap because the auth manager derives user identity from the signed session token but reads authorization decisions from unvalidated cookies, allowing potential token substitution or misuse.
Why it matters: Airflow operators using Keycloak provider version 0.10.0 or earlier should upgrade immediately, as the vulnerability permits attackers to potentially assume another user's authorization without compromising their session token.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider before version 0.10.0 fails to bind Keycloak access and refresh tokens to the authenticated Airflow session identity, instead reading them from separate unauthenticated cookies. This separation means the authorization system never validates that token cookies belong to the logged-in user, creating a session fixation or token confusion risk.
Why it matters: Organizations running Airflow 3.3 or later with Keycloak authentication should upgrade the provider to 0.10.0 or later to prevent attackers from reusing or swapping Keycloak tokens across sessions.
- Source published
- First seen by Cybersecurity Tracker