https://seclists.org/oss-sec/2026/q2/168: CVE-2026-40948: Apache Airflow Keycloak Provider: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

Q: Who can exploit this issue?

An attacker needs a Keycloak account in the same realm as the targeted Airflow deployment and must be able to get a victim to open a crafted login callback URL in their browser.

Q: What is the practical impact on a victim?

The victim can be logged into the attacker's Airflow session. Credentials the victim later stores in Airflow Connections may then be accessible to the attacker through that session.

Q: Which versions require remediation?

Apache Airflow Keycloak Provider versions from 0.0.1 before 0.7.0 are affected. Upgrade apache-airflow-providers-keycloak to version 0.7.0 or later.

Published Apr 17, 2026

Updated

Affected Software

1 affected component

pypi/apache-airflow-providers-keycloak>=0.0.1<0.7.0

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a Keycloak account in the same realm as the targeted Airflow deployment and must be able to get a victim to open a crafted login callback URL in their browser.

What is the practical impact on a victim?

The victim can be logged into the attacker's Airflow session. Credentials the victim later stores in Airflow Connections may then be accessible to the attacker through that session.

Which versions require remediation?

Apache Airflow Keycloak Provider versions from 0.0.1 before 0.7.0 are affected. Upgrade apache-airflow-providers-keycloak to version 0.7.0 or later.