CVE-2026-76186: Apache Airflow Keycloak Auth Bypass Flaw

CVE-2026-76186 Overview

CVE-2026-76186 affects the Apache Airflow Keycloak provider starting with Airflow 3.3. The Keycloak auth manager reads user identity from the signed Airflow session token but pulls Keycloak access and refresh tokens from separate, unauthenticated cookies. The auth manager never verifies that both describe the same subject. An attacker with a valid Airflow login and another user's Keycloak tokens obtained out of band can pair the two credentials. Airflow then authorizes requests using the foreign token's privileges while audit logs and cache keys record the attacker's own account. The refresh path re-issues an Airflow session token that continues to carry the foreign tokens, so the mismatched pairing persists across sessions.

Critical Impact
Authenticated attackers can impersonate higher-privileged Keycloak subjects while audit logs attribute activity to the attacker's own account, breaking accountability and access control.

Affected Products

Apache Airflow 3.3 and later with the Keycloak auth manager enabled
apache-airflow-providers-keycloak versions prior to 0.10.0
Deployments relying on Keycloak-issued access and refresh tokens for authorization decisions

Discovery Timeline

2026-09-16 - CVE-2026-76186 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76186

Vulnerability Analysis

The flaw is an authorization binding failure classified under [CWE-565: Reliance on Cookies without Validation and Integrity Checking]. The Keycloak auth manager treats two independent credential channels as if they belonged to the same principal. Identity comes from a signed Airflow session token, while authorization tokens arrive in separate cookies that carry no cryptographic link to the session. Because the code never compares the subject claim in the Keycloak access token against the session identity, an attacker can splice a foreign user's Keycloak tokens into their own authenticated session. Airflow evaluates permissions against the foreign token, granting operations the attacker's account does not possess.

Root Cause

Earlier releases embedded Keycloak tokens inside the signed Airflow session token, which bound the two credentials cryptographically. The refactor that moved Keycloak tokens into standalone cookies removed the binding without adding an equivalent subject check. The auth manager also re-issues Airflow session tokens on refresh while preserving the foreign Keycloak tokens, extending the mismatched pairing indefinitely.

Attack Vector

Exploitation requires the attacker to hold a valid Airflow login and obtain a target user's Keycloak access or refresh token through phishing, log exposure, browser compromise, or interception. The attacker submits requests with their own signed Airflow session cookie alongside the victim's Keycloak token cookies. Airflow authorizes each request using the victim's roles while writing the attacker's identity to audit trails and cache keys. See the GitHub Pull Request #72207 and Openwall OSS Security Notice for technical detail.

Detection Methods for CVE-2026-76186

Indicators of Compromise

Airflow audit log entries where the recorded user performs actions their assigned role does not permit
Keycloak access token sub claims that do not match the Airflow session identity for the same request
Session refresh events that reuse Keycloak access or refresh tokens issued to a different subject

Detection Strategies

Correlate Airflow webserver access logs with Keycloak token introspection responses and alert on sub mismatches between session identity and access token
Baseline each user's typical DAG and connection operations, then flag privilege operations that deviate from the account's assigned role
Inspect request cookies at a reverse proxy or WAF and compare the decoded Keycloak access token subject against the Airflow session identity

Monitoring Recommendations

Enable verbose Keycloak auth manager logging and forward events to a centralized SIEM for cross-source correlation
Monitor Airflow audit logs for administrative actions such as connection edits, variable changes, and DAG triggers performed by low-privileged accounts
Track Keycloak refresh token reuse patterns to detect tokens moving between distinct browser or client fingerprints

How to Mitigate CVE-2026-76186

Immediate Actions Required

Upgrade apache-airflow-providers-keycloak to version 0.10.0 or later, which binds cookie-supplied tokens to the session identity
Invalidate all active Airflow sessions and Keycloak refresh tokens after upgrade to purge any mismatched pairings
Review Airflow audit logs since the deployment of Airflow 3.3 for privilege operations inconsistent with the acting user's role

Patch Information

The fix is included in apache-airflow-providers-keycloak 0.10.0. The patch enforces a subject check that binds the Keycloak access and refresh tokens carried in cookies to the identity encoded in the signed Airflow session token. Details are available in GitHub Pull Request #72207 and the Apache Mailing List Discussion.

Workarounds

Disable the Keycloak auth manager and revert to an auth manager that binds tokens within the signed session until the upgrade is applied
Restrict Airflow access to trusted networks or place it behind a reverse proxy that validates Keycloak token subjects against session identity
Reduce Keycloak access and refresh token lifetimes to shrink the window in which stolen tokens can be paired with attacker sessions

bash

# Upgrade the Keycloak provider to the fixed release
pip install --upgrade 'apache-airflow-providers-keycloak>=0.10.0'

# Verify installed version
pip show apache-airflow-providers-keycloak | grep -i version