EUVD-2026-23676
GHSA-5w6h-pjw6-wvc6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade apache-airflow-providers-keycloak to 0.7.0 or later.
AnalysisAI
Session fixation and login-CSRF in apache-airflow-providers-keycloak prior to 0.7.0 allows remote attackers without prior authentication to hijack user sessions by delivering a crafted OAuth callback URL, enabling credential theft from stored Airflow connections. The vulnerability stems from missing OAuth 2.0 state parameter validation and lack of PKCE implementation, requiring only user interaction to trick victims into clicking a malicious link. EPSS score of 0.01% suggests minimal real-world exploitation despite moderate CVSS impact rating.
Technical ContextAI
The vulnerability exists in the OAuth 2.0 authentication flow implementation within the Keycloak provider for Apache Airflow. OAuth 2.0 requires the Authorization Server to return a state parameter matching the client's original request to prevent CSRF attacks; additionally, PKCE (RFC 7636) adds a code_challenge/code_verifier binding to prevent authorization code interception. The apache-airflow-providers-keycloak authentication manager implements neither control. An attacker with a valid Keycloak account in the target realm can forge a callback URL containing a valid authorization code (obtained from their own authentication) and deliver it to a victim. When the victim's browser processes this callback, the Airflow application accepts the authorization code without validating state parameter or PKCE, treating the attacker's valid code as proof of the victim's authentication. This is classified as CWE-352 (Cross-Site Request Forgery), manifesting as session fixation rather than traditional CSRF because the victim is authenticated into the attacker's pre-established session rather than performing an unwanted action on their own session.
RemediationAI
Upgrade apache-airflow-providers-keycloak to version 0.7.0 or later, which implements OAuth 2.0 state parameter validation and PKCE support as documented in GitHub PR #64114 and the Apache mailing list advisory. For organizations unable to immediately upgrade, temporary mitigations include disabling Keycloak OAuth 2.0 authentication in favor of alternative authentication backends (LDAP, local database authentication) - note that this eliminates SSO benefits and requires credential management changes; alternatively, strictly limit Keycloak realm membership to trusted users and implement network-level controls restricting Airflow login endpoints to corporate networks only, though these do not eliminate the vulnerability. The preferred remediation is immediate patching, as workarounds introduce operational friction and do not address the root cause.
More in Apache Airflow
View allRemote code execution in Apache Airflow before 3.3.0 lets a DAG author embed a malicious trigger whose attacker-controll
Unsafe deserialization in Apache Airflow 3.3.0's Task SDK allows an authenticated DAG author to cause arbitrary module i
Unsafe deserialization in Apache Airflow 3.0.0 through 3.3.0 allows any DAG author to achieve arbitrary code execution i
Remote code execution in Apache Airflow 3.1.x allows authenticated DAG Authors to execute arbitrary code in the webserve
Command injection in Apache Airflow's BashOperator documentation example allows authenticated attackers to escalate priv
We need to produce a JSON object per the instructions. Let's analyze each field. First, product_name: "1-3 words ONLY.
CVE-2026-30911 is a security vulnerability (CVSS 8.1) that allows any authenticated task instance. High severity vulnera
Information disclosure in Apache Airflow 3.0.0 through 3.1.x stems from incomplete secret masking and under-documented w
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI
CVE-2026-28779 is a security vulnerability (CVSS 7.5) that allows any application co-hosted under the same domain. High
Apache Airflow before 3.2.0 exposes SQL exception stack traces through API responses despite api/expose_stack_traces=fal
Apache Airflow 3.0.x prior to 3.2.0 allows remote unauthenticated attackers to trigger unauthorized DAG (Directed Acycli
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today