CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache-airflow-providers-keycloakto a version that resolves this vulnerability.Fixed in 0.11.1
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the Keycloak auth manager in apache-airflow-providers-keycloak are affected. The issue is especially relevant on shared workstations or any browser profile that another person may access after logout.
What does an attacker need to exploit this?
An attacker needs access to the same browser after the user has logged out. Because logout results in a new unrevoked token, that browser session can still be used to act as the prior user.
How can I remediate the issue?
Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later.