Session Management Flaw in Apache Airflow's Keycloak Authentication System
CVE-2026-96806

5.8MEDIUM

Key Information:

Vendor

Apache
Status
Apache Airflow Keycloak Provider
Vendor
CVE Published:
15 October 2026

What is CVE-2026-96806?

A significant session management vulnerability exists in Apache Airflow's Keycloak authentication manager. When a user logs out, the session is not properly terminated, as the logout route incorrectly issues a new, unrevoked authentication token. This flaw allows anyone with access to the same browser session to continue using the application as the logged-out user, posing serious risks in shared environments. Users are strongly advised to upgrade to apache-airflow-providers-keycloak version 0.11.1 or later to mitigate this issue.

Affected Version(s)

Apache Airflow Keycloak provider 0 < 0.11.1

References

https://github.com/apache/airflow/pull/73695
patch
https://lists.apache.org/thread/7vwjg3wn8wxkprg6csxcvs6wk...
vendor-advisory

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JelyFishhhhhh
Jarek Potiuk
.