CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider takes authorization tokens from unauthenticated cookies never checked against the signed session identity, enabling cookie substitution.
CVE-2026-76186 affects apache-airflow-providers-keycloak before 0.10.0. From Airflow 3.3, the Keycloak auth manager derives user identity from the signed Airflow session token but reads Keycloak access and refresh tokens used for every authorization decision from separate unauthenticated cookies. It never verifies that the two correspond to the same user, allowing mismatched token cookies to drive authorization decisions. Severity is rated moderate.
- Affects apache-airflow-providers-keycloak before 0.10.0 with Airflow 3.3+
- Keycloak access/refresh tokens read from unauthenticated cookies
- No binding between session identity and token cookie identity
- Authorization decisions can use substituted cookies
- CVEs
- CVE-2026-76186
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76186 | Keycloak token/session identity confusion in Apache Airflow Keycloak provider | 9.1 | — |
From the original article
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0. 10. 0 Description: Apache Airflow Keycloak provider: from Airflow 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.