CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
Apache Airflow Keycloak logout fails to end sessions because middleware reissues an unrevoked JWT.
CVE-2026-96806 affects the Apache Airflow Keycloak auth manager before version 0.11.1. Logout revokes the presented token, but KeycloakJWTMiddleware then mints a new, unrevoked token on the same response, so the session continues. Deployments using the Keycloak auth manager are affected: after logout, later access to the client can keep the user logged in. Apache rates the issue moderate.
44