Skip to content
OpenAdvisories
High WID-SEC-2026-3385 8 CVEs

Apache Airflow Providers (FAB, Keycloak, Kafka, Akeyless): Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Sep 16, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Airflow

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Airflow ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder Daten zu manipulieren und offenzulegen.

Product

Apache Airflow ist eine Plattform zur programmatischen Erstellung, Planung und Überwachung von Workflows.

Vulnerabilities 8

  • Critical 9.8
    CVE-2026-76187

    Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

    Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authe…

    Apache Software Foundation Apache Airflow Keycloak provider
  • Critical 9.8
    CVE-2026-82311

    Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

    Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's …

    Apache Software Foundation Apache Airflow FAB provider
  • Critical 9.1
    CVE-2026-76186

    Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

    Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated co…

    Apache Software Foundation Apache Airflow Keycloak provider
  • Critical 9.1
    CVE-2026-86462

    Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

    Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that…

    Apache Software Foundation Apache Airflow FAB provider
  • High 8.8
    CVE-2026-86792

    Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

    Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes t…

    Apache Software Foundation Apache Airflow Apache Kafka provider apache-airflow-providers-apache-kafka PyPI
  • High 8.1
    CVE-2026-86466

    Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

    Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client appli…

    Apache Software Foundation Apache Airflow FAB provider
  • High 7.2
    CVE-2026-82310

    Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

    Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming …

    Apache Software Foundation Apache Airflow FAB provider
  • Medium 6.5
    CVE-2026-86465

    Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

    Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the bac…

    Apache Software Foundation Apache Airflow Akeyless provider

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-80318, EUVD-2026-80322, EUVD-2026-80324, EUVD-2026-80323, EUVD-2026-80321

  2. #1

    Initiale Fassung

References