https://seclists.org/oss-sec/2026/q4/175: CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddlewamints an unvoked placement token

Q: Which deployments are exposed to this issue?

Deployments using the Apache Airflow Keycloak auth manager are affected if they run apache-airflow-providers-keycloak before version 0.11.1.

Q: What does an attacker need to exploit this?

An attacker needs access to the same browser after a user has logged out, such as on a shared workstation. The logout flow can leave the user effectively logged in by issuing a new unrevoked token.

Q: What should teams do to remediate the issue?

Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later. Until an upgrade is possible, avoid shared-browser use for affected Airflow deployments and ensure users do not leave authenticated browser sessions accessible to others.

Published Oct 15, 2026

Updated

Affected Software

1 affected component

pypi/apache-airflow-providers-keycloak<0.11.1

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the Apache Airflow Keycloak auth manager are affected if they run apache-airflow-providers-keycloak before version 0.11.1.

What does an attacker need to exploit this?

An attacker needs access to the same browser after a user has logged out, such as on a shared workstation. The logout flow can leave the user effectively logged in by issuing a new unrevoked token.

What should teams do to remediate the issue?

Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later. Until an upgrade is possible, avoid shared-browser use for affected Airflow deployments and ensure users do not leave authenticated browser sessions accessible to others.

https://seclists.org/oss-sec/2026/q4/175: CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddlewamints an unvoked placement token

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit this?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit this?

What should teams do to remediate the issue?