CVE-2026-96806

Received Received - Intake

Session Fixation in Apache Airflow Keycloak Auth Manager

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Apache Software Foundation

Description

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-96806

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache Airflow Keycloak provider 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

The Apache Airflow Keycloak auth manager has a flaw where logging out does not properly end the user session. When a user logs out, the system revokes the token but then immediately issues a new unrevoked token in the same response. This leaves the user still logged in, allowing anyone with later access to the same browser to impersonate the logged-out user.

Impact Analysis

This vulnerability allows unauthorized users to access the system as a previously logged-out user if they gain access to the same browser. This could lead to data breaches, unauthorized actions, or misuse of privileges, especially in shared workstation environments.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR and HIPAA by enabling unauthorized access to sensitive data. It undermines session management controls required for data protection and user accountability, potentially leading to regulatory penalties.

Mitigation Strategies

Upgrade to apache-airflow-providers-keycloak version 0.11.1 or later to address the session management issue in the Keycloak auth manager.

Hi! I’m here to help you understand CVE-2026-96806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70