What’s Vulnerable › Products
Apache Software Foundation Apache Airflow Keycloak provider vulnerabilities
5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.
Check whether your Apache Software Foundation Apache Airflow Keycloak provider version is affected
Latest Apache Software Foundation Apache Airflow Keycloak provider vulnerabilities
- CVE-2026-96806 — Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token (CVSS 5.8)
- CVE-2026-92228 — Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read (CVSS 6.5)
- CVE-2026-76187 — Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT (CVSS 9.8)
- CVE-2026-76186 — Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity (CVSS 9.1)
- CVE-2026-40948 — Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager (CVSS 5.4)