https://seclists.org/oss-sec/2026/q3/791: CVE-2026-76187: Apache Airflow Keycloak provider: Any alm client's cdentials mint an Airflow session JWT
Affected Software
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Keycloak auth manager are affected when their Keycloak realm is shared with other confidential clients. Versions of apache-airflow-providers-keycloak before 0.10.0 are affected.
What does an attacker need to obtain an Airflow session token?
The attacker needs valid client credentials for any confidential client registered in the shared Keycloak realm; they do not need the client credentials configured for Airflow. The token endpoint is unauthenticated and can also be used to submit credential guesses to Keycloak under Airflow's identity.
What access would a successfully exploited token provide?
Airflow mints a signed session token for the unrelated client's service account. Access is limited by that service account's existing resource authorization, but the attacker can also reach endpoints gated only on authentication.
What is the recommended remediation?
Upgrade apache-airflow-providers-keycloak to version 0.10.0 or later. The fixed version accepts only the client configured for Airflow.