CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
Apache Airflow's Keycloak provider before 0.11.1 lets any team member read every team's audit logs.
Jarek Potiuk disclosed CVE-2026-92228, rated important, in the Apache Airflow Keycloak provider before 0.11.1. Multi-team provisioning through _attach_team_permissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager are affected, so an authenticated member of one team could read other teams' audit logs. The issue is fixed in version 0.11.1.
- CVE-2026-92228 affects the Airflow Keycloak provider before 0.11.1.
- Multi-team provisioning granted every team role global audit-log read.
- Any authenticated member of one team could read other teams' logs.
- Apache rates it important; fixed in provider 0.11.1.
Vulnerabilities mentionedAll →
- CVE-2026-922286.5—Cross-team audit log read in Airflow Keycloak providerpublished · Apache Software Foundation Apache Airflow Keycloak provider (apache-airflow-providers-keycloak)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-92228 | Cross-team audit log read in Airflow Keycloak provider The Apache Airflow Keycloak provider's multi-team provisioning path (_attach_team_permissions) incorrectly assigned every team role global read access to audit logs (CWE-732). The flaw is present when multi-team mode is enabled with the Keycloak auth manager and teams are provisioned through that provider. Any authenticated member of one team could then read other teams' audit events through the UI or the event-log API. Only those Airflow deployments are affected; users of apache-airflow-providers-keycloak should move to 0.11.1 or later. There is no known public proof of concept, the issue is not on the CISA KEV list, and exploitation in the wild is not reported. |
Posted by Jarek Potiuk on Oct 15 Severity: important Affected versions: - Apache Airflow Keycloak provider before 0.11.1 Description: The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit...
This source does not provide full text. Read it at seclists.org.