CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider takes authorization tokens from unauthenticated cookies never checked against the signed session identity, enabling cookie substitution.
CVE-2026-76186 affects apache-airflow-providers-keycloak before 0.10.0. From Airflow 3.3, the Keycloak auth manager derives user identity from the signed Airflow session token but reads Keycloak access and refresh tokens used for every authorization decision from separate unauthenticated cookies. It never verifies that the two correspond to the same user, allowing mismatched token cookies to drive authorization decisions. Severity is rated moderate.
- Affects apache-airflow-providers-keycloak before 0.10.0 with Airflow 3.3+
- Keycloak access/refresh tokens read from unauthenticated cookies
- No binding between session identity and token cookie identity
- Authorization decisions can use substituted cookies
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76186 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0.10.0 Description: Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
This source does not provide full text. Read it at seclists.org.