CVE-2026-92228: CWE-732: Incorrect Permission Assignment for Critical Resource in Apache Software Foundation Apache Airflow Keycloak provider
Description
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Affected software
Apache Software Foundation
Apache Airflow Keycloak provider
Weaknesses
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-15T18:57:18.814Z
- State
- PUBLISHED
Threat ID: 6ad14e352cdf04f656608540
Added to database: 10/15/2026, 22:05:41 UTC
Last updated: 10/15/2026, 22:05:41 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.