CVE-2026-40948
Description
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
How to fix
- apache apache-airflow-providers-keycloak0.7.0 or later
- apache-airflow-providers-keycloak0.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache apache-airflow-providers-keycloak | 0.0.1 ≤ v < 0.7.0 | 0.7.0 |
| apache-airflow-providers-keycloakPyPI | 0.0.1 ≤ v < 0.7.0 | 0.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.