Apache-airflow-providers-keycloak vulnerabilities

2 known vulnerabilities in Apache-airflow-providers-keycloak from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Apache Airflow Keycloak provider: Improper Authentication

  CVE-2026-76187Sep 16, 2026Apache

  Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authen

• 9.1 Critical severity

  Apache Airflow Keycloak provider: Reliance on Cookies without Validation and Integrity Checking

  CVE-2026-76186Sep 16, 2026Apache

  Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated coo