CVE-2026-92228— Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
Quick assessment
Affected
Apache Software Foundation Apache Airflow Keycloak provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Airflow 的 Keycloak 提供程序中的多团队配置功能（ ）存在安全漏洞，该漏洞使得每个团队角色都获得了审计日志的全局读取权限。在启用了多团队模式并使用 Keycloak 身份验证管理器以及通过该管理器配置团队的环境中，此漏洞会影响系统：任何经过身份验证的团队成员都可以通过用户界面或事件日志 API 读取其他团队的审计事件。 建议 apache-airflow-providers-keycloak 的用户升级至版本 0.11.1 或更高版本。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92228
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow Keycloak provider | 0 ~ 0.11.1 | - |
|
II. Public POCs for CVE-2026-92228
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92228
请登录查看更多情报信息。
Other References for CVE-2026-92228 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-15 · 4 CVEs total
| CVE-2026-94135 | Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default | |
| CVE-2026-96806 | Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the se | |
| CVE-2026-94134 | Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key veri |
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-94135
Apache Airflow SFTP provider: Async SFTP hook disables host- -
CVE-2026-96806
Apache Airflow Keycloak provider: Keycloak auth manager: log -
CVE-2026-94134
Apache Airflow SSH provider, Apache Airflow SFTP provider: S -
CVE-2026-107460
Apache Fesod (Incubating): UrlImageConverter SSRF protection -
CVE-2026-92120
Apache Allura: Oauth1 Replay Attack
Same weakness: CWE-732
-
CVE-2026-34008
**Privilege Escalation** World-writable crontab path monitor -
CVE-2026-34014
ds-move-files.sh is writable and executed as root -
CVE-2026-104618
sdbootutil: world-readable debug log -
CVE-2026-87093
MOVEit Transfer Service Directory Writable by Local Users En -
CVE-2026-70402
Gitea local code execution through writable Git hooks
V. Comments for CVE-2026-92228
No comments yet