CVE-2026-40948: Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager
The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade apache-airflow-providers-keycloak to 0.7.0 or later.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40948?
CVE-2026-40948 is a high-severity vulnerability due to the lack of validation on the OAuth 2.0 state parameter which may lead to CSRF attacks.
How do I fix CVE-2026-40948?
To fix CVE-2026-40948, upgrade the `apache-airflow-providers-keycloak` package to version 0.7.0 or higher.
What is the impact of CVE-2026-40948?
The impact of CVE-2026-40948 includes the potential for attackers to exploit CSRF vulnerabilities during the OAuth 2.0 authentication process.
Which versions of software are affected by CVE-2026-40948?
CVE-2026-40948 affects all versions of `apache-airflow-providers-keycloak` below 0.7.0.
Is there a mitigation for CVE-2026-40948 without upgrading?
There is no effective mitigation for CVE-2026-40948 other than upgrading to the fixed version.