Apache-airflow-providers-keycloak (Apache) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 17 known versions, newest CVE from 2026-09-16. Vendor: Apache.

CVEs of Apache-airflow-providers-keycloak

• CVE-2026-76187 - CVSS 9.8 (critical), 2026-09-16: Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak…
• CVE-2026-76186 - CVSS 9.1 (critical), 2026-09-16: Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the…
• CVE-2026-40948 - CVSS 5.4 (medium), 2026-04-18: The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login /…