The vulnerability in Apache Airflow Providers Keycloak (CVE-2026-40948) arises from the lack of generation and validation of the OAuth 2.0 state parameter and absence of PKCE in the login and login-callback flow. This allows an attacker with a Keycloak account in the same realm to perform login-CSRF or session fixation attacks by delivering a crafted callback URL to a victim. The victim's browser is tricked into logging into the attacker’s Airflow session, potentially exposing any credentials the victim stores in Airflow Connections to the attacker. The affected version is 0.0.1, and upgrading to 0.7.0 or later is recommended. The CVSS v3.1 base score is 5.4, indicating medium severity.

An attacker with a Keycloak account in the same realm can cause a victim to unknowingly log into the attacker's Airflow session, enabling the attacker to harvest credentials stored by the victim in Airflow Connections. This compromises confidentiality of stored credentials but does not affect availability. The attack requires user interaction (UI:R) and network access (AV:N) with no privileges required (PR:N).

Users should upgrade the apache-airflow-providers-keycloak package to version 0.7.0 or later, where this vulnerability is addressed. Patch status is not explicitly confirmed in the vendor advisory, so users should verify the latest vendor guidance for official fixes. Until upgraded, users should be cautious of unsolicited or suspicious login callback URLs related to Keycloak authentication flows.