What’s Vulnerable › Vulnerabilities

CVE-2026-40948: Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-18 · updated 2026-10-25
• Weakness: CWE-352

Description

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.

Affected products

• Apache Software Foundation Apache Airflow Keycloak provider: from 0.0.1 before 0.7.0 — fixed in 0.7.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow Keycloak provider 0.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/64114
• https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q
• http://www.openwall.com/lists/oss-security/2026/04/17/14

Get alerted when CVE-2026-40948 or the next vulnerability affects your stack