Threats Tagged 'ghsa-rwpr-5hxh-f9cm'

CVE-2026-76187 is a critical improper authentication vulnerability in the Apache Airflow Keycloak provider. The unauthenticated token endpoint accepts client-credentials grants from any confidential client registered in the shared Keycloak realm, not just the client configured for Airflow. This allows an attacker with valid credentials for any client in the realm to authenticate as that client in Airflow and obtain a signed session token. The vulnerability affects deployments using the Keycloak auth manager with a shared realm among multiple confidential clients. Upgrading to apache-airflow-providers-keycloak version 0.10.0 or later mitigates this issue by restricting authentication to the configured client only.