CVE-2026-40948
published 2026-04-18CVE-2026-40948: The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login /…
PriorityP430medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.36%
28.3th percentile
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apache-airflow-providers-keycloak | >= 0.0.1 < 0.7.0 | 0.7.0 |
| apache_software_foundation | apache_airflow_amazon_provider | < 9.38.0 | 9.38.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it.
ghsa_unreviewed·2026-10-20·CVSS 5.4
CVE-2026-86467 [MEDIUM] CWE-352 Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it.
Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated attacker who can cause a victim to load a page can complete a SAML login in the victim's browser using the attacker's own assertion, silently logging the victim into the attacker's Airflow account. Subsequent work the victim performs lands in a session the attacker controls.
Affects deployments using the AWS auth manager with SAML authentication. The victim needs only to visit an attacker-controlled page; no Airflow account or credential is required of the attacker. This is the same login-CSRF clas
GHSA
GHSA-5w6h-pjw6-wvc6: The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2
ghsa_unreviewed·2026-04-18
CVE-2026-40948 CWE-352 GHSA-5w6h-pjw6-wvc6: The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
GHSA
apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation
ghsa·2026-04-18
CVE-2026-40948 [MEDIUM] CWE-352 apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation
apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
VulDB
Apache Airflow Keycloak Provider up to 0.6.x OAuth Login cross-site request forgery
vuldb·2026-04-17
CVE-2026-40948 [LOW] Apache Airflow Keycloak Provider up to 0.6.x OAuth Login cross-site request forgery
A vulnerability was found in Apache Airflow Keycloak Provider up to 0.6.x. It has been rated as problematic. This affects an unknown function of the component OAuth Login. Performing a manipulation results in cross-site request forgery.
This vulnerability was named CVE-2026-40948. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-18
Published