30
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider takes authorization tokens from unauthenticated cookies never checked against the signed session identity, enabling cookie substitution.
CVE-2026-76186 affects apache-airflow-providers-keycloak before 0.10.0. From Airflow 3.3, the Keycloak auth manager derives user identity from the signed Airflow session token but reads Keycloak access and refresh tokens used for every authorization decision from separate unauthenticated cookies. It never verifies that the two correspond to the same user, allowing mismatched token cookies to drive authorization decisions. Severity is rated moderate.
30
60
42
42
42
60
30
55
60
60
30
60
30
30
55
55
55
55
30
CVE-2026-50522: Patch Critical SharePoint RCE Now
Microsoft patched CVE-2026-50522 (CVSS 9.8), an unauthenticated deserialization RCE in on-premises SharePoint servers, in its July 2026 updates; no exploitation confirmed at disclosure.
CVE-2026-50522 is a critical (CVSS 9.8) deserialization of untrusted data flaw (CWE-502) allowing unauthenticated remote code execution on on-premises Microsoft SharePoint servers. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, with fixes shipped in Microsoft's July 14, 2026 security updates; SharePoint Online is not listed as affected. No public evidence of active exploitation of this specific CVE existed at disclosure, though CISA's SSVC judged the attack automatable with total technical impact.
72
55
60
60
30
55
42
30
55
30
55
60
55
30
42
55
42
30
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.
CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.
30
30