https://seclists.org/oss-sec/2026/q3/790: CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Published Sep 15, 2026
·Updated
Affected Software
1 affected component
apache-airflow-providers-keycloak<0.10.0
Frequently Asked Questions
1
Which deployments are affected?
Deployments running Airflow 3.3 or later with the Keycloak auth manager are affected when using apache-airflow-providers-keycloak before 0.10.0. Earlier Airflow versions kept Keycloak tokens inside the signed session token and retained the identity binding.
2
What does an attacker need to exploit this issue?
An attacker needs a valid Airflow login for their own account and another user's Keycloak access token or refresh token obtained out of band. They can pair those tokens so authorization uses the other user's Keycloak privileges while the Airflow session and audit records remain associated with the attacker's account.