CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.
CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.
- Affects apache-airflow-providers-keycloak before 0.10.0
- Token endpoint accepts any realm client's client-credentials grant
- No allowlist on permitted client ids
- Unrelated application credentials can mint Airflow session JWTs
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76187 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Vincent Beck on Sep 15 Severity: moderate Affected versions: - Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0.10.0 Description: Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an unrelated...
This source does not provide full text. Read it at seclists.org.