Apache Software Foundation Apache Airflow Keycloak Provider vulnerabilities

2 CVEs affecting Apache Software Foundation Apache Airflow Keycloak Provider, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96806, published 2026-10-15.

More from Apache Software Foundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-96806, published 2026-10-15. Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days. The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same…
• CVE-2026-92228, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the…