CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning (attachteampermissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-keycloakto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the Keycloak auth manager, enable multi-team mode, and provision teams through the Keycloak provider. Deployments that do not meet those conditions are not identified as affected by the available information.
What access does an attacker need to exploit this issue?
An attacker needs to be an authenticated member of any provisioned team. They could then read audit events belonging to other teams through the Airflow UI or the event-log API.
Is an update available?
Yes. Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later.