Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-96806— Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

Quick assessment

Affected
Apache Software Foundation Apache Airflow Keycloak provider
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Airflow 的 Keycloak 身份验证管理器在用户注销时未正确结束会话：注销路由虽然撤销了提交的令牌，但 随后在同一响应中生成了一个新的、未被撤销的令牌，导致用户仍处于登录状态。所有使用 Keycloak 身份验证管理器的部署均受此漏洞影响：用户注销后，任何后续访问同一浏览器的人（例如在共享工作站上）均可继续以该用户的身份进行操作。 建议 用户升级至版本 0.11.1 或更高版本。

AI Predicted 5.0 Difficulty: Trivial EPSS 0.24% · P14

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Airflow Keycloak provider < 0.11.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-96806

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
Source: CVE Program / CVE List V5
Vulnerability Description
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Airflow Keycloak provider 0 ~ 0.11.1 -

II. Public POCs for CVE-2026-96806

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-96806

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-96806 (1)

Mailing List Discussions for CVE-2026-96806 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-15 · 4 CVEs total

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key veri
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role

IV. Related Vulnerabilities

Same product: Apache Airflow Keycloak provider
Same vendor: Apache Software Foundation
Same weakness: CWE-613

V. Comments for CVE-2026-96806

No comments yet

Leave a comment