CVE-2026-92228

Received Received - Intake

Privilege Escalation in Apache Airflow Keycloak Provider

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Apache Software Foundation

Description

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-92228

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Airflow Keycloak provider 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

The Apache Airflow Keycloak provider has a vulnerability in its multi-team provisioning feature. When enabled, it grants all team roles global read access to audit logs. This means any authenticated user from one team can view audit events of other teams through the UI or API.

Impact Analysis

If you use Apache Airflow with the Keycloak provider in multi-team mode, unauthorized users may access sensitive audit logs. This could expose confidential operations, user activities, or security events across teams.

Compliance Impact

This vulnerability may violate compliance requirements like GDPR or HIPAA by exposing audit logs to unauthorized users. Unauthorized access to logs could lead to data breaches or non-compliance with privacy regulations.

Mitigation Strategies

Upgrade the Apache Airflow Keycloak provider to version 0.11.1 or later to address the global read access issue in audit logs.

Hi! I’m here to help you understand CVE-2026-92228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70