AI analysis
The Apache Airflow Keycloak auth manager does not end the session when a user logs out. The logout route revokes the presented token, but KeycloakJWTMiddleware then mints a new, unrevoked token on the same response, so the user stays logged in. Anyone who later uses the same browser, such as on a shared workstation, can continue to act as that user. Only deployments of apache-airflow-providers-keycloak that use the Keycloak auth manager are affected. No public proof of concept is known, the issue is not in CISA KEV, and there is no report of exploitation in the wild.
What to do: Upgrade apache-airflow-providers-keycloak to 0.11.1 or later on every deployment that uses the Keycloak auth manager. After upgrading, confirm that logout actually ends the session and that no replacement token is issued. On shared workstations, have users who logged out before the fix clear site cookies and sign in again so leftover sessions cannot be reused.
Affected
| Apache Software Foundation apache-airflow-providers-keycloak | versions before 0.11.1 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.