Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-76186: Apache Airflow Keycloak provider can let user assume another's rights
CVE-2026-76186 · published 9 days ago
Summary
If you run Apache Airflow version 3.3 or newer with the Keycloak authentication add‑on, a user’s login session can be combined with a different person’s Keycloak token, giving the attacker the other person’s permissions while the audit log still shows the attacker’s name. This happens because the system stores the Keycloak tokens in separate cookies that are not checked against the logged‑in user. Upgrade the Keycloak provider to version 0.10.0 or later, which ties the tokens to the correct user session.
What to do
- Update apache software foundation apache airflow keycloak provider to version 0.10.0 or later.
- Update apache apache-airflow-providers-keycloak to version 0.10.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache airflow keycloak provider | < 0.10.0 |
| apache | apache-airflow-providers-keycloak |
< 0.10.0 cpe:2.3:a:apache:apache-airflow-providers-keycloak:*:*:*:*:*:*:*:* |
Original advisory text
Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two describe the same subject. A user who holds any valid Airflow login of their own, together with another subject's Keycloak access or refresh token obtained out of band, can pair the two: Airflow then authorizes requests with the foreign token's privileges while the session identity, audit log and cache keys continue to name the attacker's own account. The refresh path re-issues an Airflow session token for the original identity carrying the foreign tokens, so the mismatched pairing survives across sessions.
Affects deployments running Airflow 3.3 or later with the Keycloak auth manager. Earlier versions carried the Keycloak tokens inside the signed session token, so the binding existed and was lost when they moved into separate cookies.
Users of apache-airflow-providers-keycloak are recommended to upgrade to version 0.10.0 or later, which binds the cookie-supplied tokens to the session identity.
Affects deployments running Airflow 3.3 or later with the Keycloak auth manager. Earlier versions carried the Keycloak tokens inside the signed session token, so the binding existed and was lost when they moved into separate cookies.
Users of apache-airflow-providers-keycloak are recommended to upgrade to version 0.10.0 or later, which binds the cookie-supplied tokens to the session identity.
References
- https://github.com/apache/airflow/pull/72207 Patch
- https://lists.apache.org/thread/5cqh5ojl3718ogb0q1dcd9vdr47z7gp3 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/09/15/8 URL
- https://lists.apache.org/thread/[email protected]... Vendor Advisory
- https://pypi.python.org URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-76186 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76186... Vendor Advisory
Severity
9.1
Critical
Exploitation
EPSS <1%
Type
CWE-565Reliance on Cookies without Validation and Integrity Checking
Timeline
Published16 Sep 2026
Updated25 Sep 2026
First seen16 Sep 2026
Track software like this
Free during beta