Four Apache Airflow Keycloak and SSH/SFTP provider flaws

Airflow Keycloak, SSH, and SFTP providers before fixed versions allow cross-team audit reads, logout bypass, and default host-key checks off.

Four Apache Airflow provider flaws were disclosed on oss-security on 15 October 2026. CVE-2026-92228, rated important, affects the Keycloak provider before 0.11.1: when multi-team mode is used with the Keycloak auth manager, provisioning via _attach_team_permissions gave every team role global read access to audit logs, so a member of one team could read other teams' logs; it is fixed in 0.11.1 and was disclosed by Jarek Potiuk. CVE-2026-96806, rated moderate and also fixed in Keycloak provider 0.11.1, leaves sessions alive because logout revokes the presented token but KeycloakJWTMiddleware then issues an unrevoked replacement; later client access can keep the user logged in, and exploitation is not reported. CVE-2026-94134, rated moderate, affects the SSH and SFTP providers before 7.0.0, where the SSH hook accepts any server key unless host_key is set or no_host_key_check is explicitly false, allowing machine-in-the-middle impersonation of default connections. CVE-2026-94135, also moderate and in the SFTP provider before 7.0.0, does the same on deferrable paths in SFTPTrigger, SFTPHookAsync, and SFTPClientPool unless no_host_key_check is false. The four reports agree on affected versions, ratings, and impact.

• CVE-2026-92228 (important) affects the Apache Airflow Keycloak provider before 0.11.1: multi-team provisioning through _attach_team_permissions granted every team role global audit-log read, so an authenticated member of one team could…
• CVE-2026-96806 (moderate) affects the Keycloak auth manager before 0.11.1: logout revokes the presented token, but KeycloakJWTMiddleware mints a new unrevoked token on the same response, so the session continues. Exploitation is not…
• CVE-2026-94134 (moderate) affects the SSH and SFTP providers before 7.0.0: the SSH hook disables host-key verification unless host_key is configured or no_host_key_check is explicitly false, so default connections accept any server key and…
• CVE-2026-94135 (moderate) affects the SFTP provider before 7.0.0: deferrable paths in SFTPTrigger, SFTPHookAsync, and SFTPClientPool skip SSH host-key verification unless no_host_key_check is false, so deferrable sensors and operators are…
• All four advisories appeared on oss-security on 2026-10-15 (about 22:59–23:05 UTC). The reports do not disagree on versions, severity, or impact.