All vulnerabilities
CVE-2026-96806

Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

Apache Software Foundation Apache Airflow Keycloak providerIdentity & access
Open in ThreatlineRecord JSON
CVSS
5.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.11.1Fixed versionCVE List
Published15 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 0.11.1Apache Airflow Keycloak providerCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user.

Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

Text from CVE List

Affected versions 1

  • Apache Airflow Keycloak provideraffected: all versions before 0.11.1CVE List

References 2