CVE-2026-92228
UnknownSummary
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments enabling multi-team mode with the Keycloak auth manager are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Risk Assessment
Audit log confidentiality breach — members of one team can view other teams' events, potentially exposing sensitive operational information and violating data separation between teams.
Recommendation
Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later.
Other vulnerabilities in Apache Airflow Keycloak provider
See all- CVE-2026-76187Critical
In Apache Airflow Keycloak provider, the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. The lack of an allowlist allows credentials of another application to be valid Airflow login credentials.
- CVE-2026-76186Critical
In Apache Airflow Keycloak provider from version 3.3, the user identity is taken from the signed Airflow session token, but the Keycloak access and refresh tokens used for authorization come from separate, unauthenticated cookies and are never checked for consistency with the identity. This allows pairing foreign tokens with one's own session.
Original NVD description (English source)
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS