Apache Airflow: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 2

• High 8.8
  CVE-2026-86467

  Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

  Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching…

  Apache Software Foundation Apache Airflow Amazon provider
  Oct 20, 2026
• Medium 5.4
  CVE-2026-40948

  Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

  The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliv…

  Apache Software Foundation Apache Airflow Providers Keycloak apache-airflow-providers-keycloak PyPI
  Apr 18, 2026

Revision history

1. 2026-10-19 #1

   Initiale Fassung

References

• CVE Record vom 2026-10-19
  https://www.cve.org/CVERecord?id=CVE-2026-40948
• CVE Record vom 2026-10-19
  https://www.cve.org/CVERecord?id=CVE-2026-86467
• Apache Mailing List vom 2026-10-19
  https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q
• Apache Mailing List vom 2026-10-19
  https://lists.apache.org/thread/xr9d2jyk9qpglsmromt6vjl4s9jb5qn8