CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager does not end the session when a user logs out. The logout route revokes the presented token, but KeycloakJWTMiddleware then mints a new, unrevoked token on the same response, so the user stays logged in. Anyone who later uses the same browser, such as on a shared workstation, can continue to act as that user. Only deployments of apache-airflow-providers-keycloak that use the Keycloak auth manager are affected. No public proof of concept is known, the issue is not in CISA KEV, and there is no report of exploitation in the wild.

Do: Upgrade apache-airflow-providers-keycloak to 0.11.1 or later on every deployment that uses the Keycloak auth manager. After upgrading, confirm that logout actually ends the session and that no replacement token is issued. On shared workstations, have users who logged out before the fix clear site cookies and sign in again so leftover sessions cannot be reused.