CVE-2026-92228mediumCWE-732

CVE-2026-92228: falha de média gravidade em Apache Airflow Keycloak provider

Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Airflow Keycloak provider

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.3%
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Apache Software Foundation · Apache Airflow Keycloak provider
CVEs relacionadas — Apache Airflow Keycloak provider

No mesmo produto, das mais perigosas para as menos.

CVE-2026-76187CRITICALApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTEPSS 1.0%CVE-2026-76186CRITICALApache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identityEPSS 0.8%CVE-2026-96806MEDIUMApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenEPSS 0.4%