AI analysis
The Apache Airflow Keycloak provider's multi-team provisioning path (_attach_team_permissions) incorrectly assigned every team role global read access to audit logs (CWE-732). The flaw is present when multi-team mode is enabled with the Keycloak auth manager and teams are provisioned through that provider. Any authenticated member of one team could then read other teams' audit events through the UI or the event-log API. Only those Airflow deployments are affected; users of apache-airflow-providers-keycloak should move to 0.11.1 or later. There is no known public proof of concept, the issue is not on the CISA KEV list, and exploitation in the wild is not reported.
What to do: Upgrade apache-airflow-providers-keycloak to 0.11.1 or later. Until then, treat multi-team mode with the Keycloak auth manager as exposing every team's audit events to any authenticated member of any team via the UI and the event-log API, and review who can sign in under that setup.
Affected
| Apache Software Foundation Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) | versions before 0.11.1 when multi-team mode is enabled with the Keycloak auth manager and teams are provisioned through it |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.