PT-2026-33603 · Apache · Apache Airflow

Haruki Oyama · Published 2026-04-18 · Updated 2026-04-18 · CVE-2026-40948

Mitre

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade apache-airflow-providers-keycloak to 0.7.0 or later.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-40948

Affected Products

Apache Airflow

References · 4

• https://github.com/apache/airflow/pull/64114 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40948 · Security Note
• https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/04/17/14 · Note