Apache Airflow Keycloak provider before 0.10.0: unauthenticated token cookies not bound to session identity and any realm client can mint a session JWT (CVE-2026-76186,…

Two moderate-severity flaws affect apache-airflow-providers-keycloak before 0.10.0: Keycloak access/refresh tokens read from unauthenticated cookies are never checked against the signed Airflow session identity (CVE-2026-76186), and the unauthenticated token…

Two vulnerabilities disclosed via oss-security on 2026-09-15 affect apache-airflow-providers-keycloak before 0.10.0, both rated moderate severity. CVE-2026-76186: Starting with Airflow 3.3, the Keycloak auth manager derives user identity from the signed Airflow session token but reads the Keycloak access and refresh tokens used for every authorization decision from separate unauthenticated cookies. Because it never verifies that the two sets of credentials correspond to the same user, mismatched or substituted token cookies can drive authorization decisions. CVE-2026-76187: The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not just the client configured for Airflow. With no allowlist restricting permitted client ids, credentials of an unrelated application can obtain an Airflow session JWT. Both issues are addressed by the version boundary stated in the advisories (versions before 0.10.0 are affected). No exploitation in the wild is reported, and no sources disagree on the facts.