CVE-2026-96806mediumCWE-613

CVE-2026-96806: falha de média gravidade em Apache Airflow Keycloak provider

Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Airflow Keycloak provider

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.8epss 0.4%
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
Apache Software Foundation · Apache Airflow Keycloak provider
CVEs relacionadas — Apache Airflow Keycloak provider

No mesmo produto, das mais perigosas para as menos.

CVE-2026-76187CRITICALApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTEPSS 1.0%CVE-2026-76186CRITICALApache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identityEPSS 0.8%CVE-2026-92228MEDIUMApache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log readEPSS 0.3%