CVE-2026-40948 Details
Description
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.
A vulnerability exists in the Keycloak authentication manager of the Apache Airflow Keycloak provider, specifically in versions 0.0.1 prior to 0.7.0. The issue arises because the authentication manager failed to generate or validate the OAuth 2.0 'state' parameter during the login and login-callback flows, and did not implement Proof Key for Code Exchange (PKCE). This oversight allows an attacker with a Keycloak account in the same realm to send a crafted callback URL to a victim's browser. As a result, the victim could be logged into the attacker's Airflow session, leading to a login Cross-Site Request Forgery (CSRF) or session fixation attack. Consequently, any credentials the victim later saved in Airflow Connections could be accessed by the attacker.
Users are advised to upgrade to Apache Airflow Keycloak Provider version 0.7.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/17/14 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/airflow/pull/64114 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/kc0odpr70hbqhdb9ksnz42fkqz2xld9q | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache apache-airflow-providers-keycloak | >= 0.0.1, < 0.7.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |
| Apr 18, 2026 | CVE Modified | CVE |