Apache Airflow Keycloak Provider
Monthly
Insufficient session termination in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak before 0.11.1) leaves a user's session valid after logout, so anyone who later gains access to the same browser - for example on a shared, kiosk, or unattended workstation - can continue acting as that user with the victim's full privileges. The logout route does revoke the presented Airflow JWT, but KeycloakJWTMiddleware re-issues a fresh, unrevoked token in the same HTTP response, so the session never actually ends. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:N, needing only subsequent local/physical access to the victim's browser), affects only deployments configured with the Keycloak auth manager, has no public exploit identified at time of analysis, and is fixed in apache-airflow-providers-keycloak 0.11.1.
Information disclosure in the Apache Airflow Keycloak provider's multi-team mode lets any authenticated member of one provisioned team read other teams' audit events through the Airflow UI or the event-log API, because audit-log rows not tied to a Dag were authorized against the shared 'View' resource that every team role can read. Only deployments with '[core] multi_team' enabled, the Keycloak auth manager configured, and teams provisioned via 'airflow keycloak-auth-manager create-team' are affected; the default single-team mode, non-Keycloak auth managers, and unauthenticated users are unaffected (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-732). The exposure is read-only and bounded by the requirement for valid team-member credentials, no public exploit code was identified at time of analysis, and the fix is available in apache-airflow-providers-keycloak 0.11.1 or later.
Insufficient session termination in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak before 0.11.1) leaves a user's session valid after logout, so anyone who later gains access to the same browser - for example on a shared, kiosk, or unattended workstation - can continue acting as that user with the victim's full privileges. The logout route does revoke the presented Airflow JWT, but KeycloakJWTMiddleware re-issues a fresh, unrevoked token in the same HTTP response, so the session never actually ends. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:N, needing only subsequent local/physical access to the victim's browser), affects only deployments configured with the Keycloak auth manager, has no public exploit identified at time of analysis, and is fixed in apache-airflow-providers-keycloak 0.11.1.
Information disclosure in the Apache Airflow Keycloak provider's multi-team mode lets any authenticated member of one provisioned team read other teams' audit events through the Airflow UI or the event-log API, because audit-log rows not tied to a Dag were authorized against the shared 'View' resource that every team role can read. Only deployments with '[core] multi_team' enabled, the Keycloak auth manager configured, and teams provisioned via 'airflow keycloak-auth-manager create-team' are affected; the default single-team mode, non-Keycloak auth managers, and unauthenticated users are unaffected (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-732). The exposure is read-only and bounded by the requirement for valid team-member credentials, no public exploit code was identified at time of analysis, and the fix is available in apache-airflow-providers-keycloak 0.11.1 or later.