Apache Apache-Airflow-Providers-Keycloak vulnerabilities

3 CVEs affecting Apache Apache-Airflow-Providers-Keycloak, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76187, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-76187, published 2026-09-16. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured…
CVE-2026-76186, published 2026-09-16. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for…
CVE-2026-40948, published 2026-04-18. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An…