Deployments using the Keycloak auth manager are affected when their Keycloak realm is shared with other confidential clients. Versions of apache-airflow-providers-keycloak before 0.10.0 are affected.
The attacker needs valid client credentials for any confidential client registered in the shared Keycloak realm; they do not need the client credentials configured for Airflow. The token endpoint is unauthenticated and can also be used to submit credential guesses to Keycloak under Airflow's identity.
Airflow mints a signed session token for the unrelated client's service account. Access is limited by that service account's existing resource authorization, but the attacker can also reach endpoints gated only on authentication.
Upgrade apache-airflow-providers-keycloak to version 0.10.0 or later. The fixed version accepts only the client configured for Airflow.