PT-2026-33603 · Apache Airflow · Apache Airflow Providers Keycloak

Haruki Oyama · Published 2026-04-18 · Updated 2026-05-11 · CVE-2026-40948

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.7.0

Description The Keycloak authentication manager fails to generate or validate the OAuth 2.0 state parameter during the login and login-callback flow and does not implement PKCE (Proof Key for Code Exchange), a security extension to OAuth 2.0 that prevents authorization code injection. An attacker with a Keycloak account in the same realm can deliver a crafted callback URL to a victim's browser, forcing the victim to be logged into the attacker's Airflow session. This login-CSRF or session fixation allows the attacker to harvest any credentials the victim subsequently stores in Airflow Connections.

Recommendations Upgrade to version 0.7.0 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-40948

GHSA-5W6H-PJW6-WVC6

Affected Products

Apache Airflow Providers Keycloak

References · 8

• https://github.com/apache/airflow/pull/64114 · Patch
• https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40948 · Security Note
• https://osv.dev/vulnerability/GHSA-5w6h-pjw6-wvc6 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://t.me/cveNotify/163051 · Telegram Post
• http://openwall.com/lists/oss-security/2026/04/17/14 · Note
• https://twitter.com/oss_security/status/2045900926565675377 · Twitter Post