CVE-2026-76187 Overview
The Apache Airflow Keycloak provider contains an authentication bypass flaw in its token endpoint. The endpoint accepts client-credentials grants from any confidential client registered in the shared Keycloak realm, not only the client configured for Airflow. An attacker holding valid credentials for any unrelated confidential client in the same realm can authenticate to Airflow. Airflow then mints a signed session token bound to that application's service account. The vulnerability is classified as Improper Authentication [CWE-287] and affects apache-airflow-providers-keycloak versions prior to 0.10.0.
Critical Impact
Credentials from any confidential client sharing the Keycloak realm become valid Airflow login credentials, granting attackers access to Airflow endpoints gated only on authentication.
Affected Products
- Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) versions prior to 0.10.0
- Airflow deployments configured to use the Keycloak auth manager
- Environments where the Keycloak realm is shared with other confidential clients
Discovery Timeline
- 2026-09-16 - CVE-2026-76187 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-76187
Vulnerability Analysis
The Keycloak auth manager exposes an unauthenticated token endpoint used to exchange client credentials for an Airflow session. The endpoint forwards the submitted client_id and client_secret to Keycloak's token endpoint under the client-credentials grant. Airflow does not restrict which client_id values are permitted. Any successful token response from Keycloak, regardless of which realm client issued it, is treated as a valid Airflow authentication.
The endpoint also acts as an unauthenticated oracle for credential guessing against the entire Keycloak realm. Guesses appear to Keycloak as originating from Airflow's identity, obscuring the source of the probe. Authorization checks inside Airflow are still evaluated per subject, so the effective privilege matches whatever the impersonated service account holds. Endpoints gated only on being authenticated are exposed to any successful bypass.
Root Cause
The provider does not maintain an allowlist of accepted client_id values on the token exchange path. The trust boundary is incorrectly placed at the Keycloak realm rather than at the specific Airflow client configuration. Any confidential client that shares the realm is implicitly promoted to a valid Airflow authenticator.
Attack Vector
An attacker obtains valid credentials for any confidential client registered in the Keycloak realm used by Airflow. This can be credentials for an unrelated internal application, a compromised service account, or a client whose secret was leaked in logs or source repositories. The attacker submits those credentials to the Airflow Keycloak provider's token endpoint using the client-credentials grant. Airflow accepts the token, issues a signed session, and grants access under the service account's identity. The same endpoint can be abused for unauthenticated credential guessing across the realm.
See the GitHub Pull Request for Airflow and the OpenWall OSS Security Discussion for the fix details.
Detection Methods for CVE-2026-76187
Indicators of Compromise
- Airflow session tokens issued for subjects whose client_id does not match the configured Airflow client
- Keycloak audit logs showing successful client-credentials grants originating from the Airflow host but requesting tokens for unrelated clients
- Unusual spikes in failed authentication attempts against the Airflow Keycloak token endpoint, indicating credential guessing
- Airflow API access from service accounts that were never intended to interact with Airflow
Detection Strategies
- Correlate Airflow authentication events with Keycloak token issuance to identify mismatches between the requesting client and the configured Airflow client
- Alert on any Airflow session whose subject azp (authorized party) claim differs from the expected Airflow client identifier
- Baseline the set of service accounts that legitimately authenticate to Airflow and flag deviations
Monitoring Recommendations
- Enable verbose logging on the Keycloak realm and forward events to a centralized analytics platform for correlation with Airflow access logs
- Monitor the Airflow token endpoint for high-volume or high-diversity client_id submissions consistent with enumeration
- Track authentication rate and error patterns on the Keycloak /token endpoint attributable to the Airflow host
How to Mitigate CVE-2026-76187
Immediate Actions Required
- Upgrade apache-airflow-providers-keycloak to version 0.10.0 or later, which accepts only the configured Airflow client on the client-credentials grant
- Rotate secrets for all confidential clients registered in the Keycloak realm shared with Airflow
- Audit Keycloak audit logs for successful token issuance to non-Airflow clients originating from Airflow infrastructure
- Review Airflow access logs for actions performed by unexpected service account subjects
Patch Information
The fix is included in apache-airflow-providers-keycloak version 0.10.0. The updated provider validates the incoming client_id against the configured Airflow client and rejects grants issued to any other confidential client in the realm. Details are available in the Apache Mailing List Thread and the GitHub Pull Request for Airflow.
Workarounds
- Move Airflow to a dedicated Keycloak realm that contains no other confidential clients until the provider can be upgraded
- Restrict network access to the Airflow Keycloak token endpoint so that only trusted networks can submit authentication requests
- Disable the client-credentials grant on all non-Airflow confidential clients in the shared realm where feasible
- Enforce short secret lifetimes and rotation for confidential clients in the shared realm to limit the window of abuse
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.