CVE-2026-96806: Apache Airflow Keycloak Auth Bypass Flaw

CVE-2026-96806 Overview

CVE-2026-96806 is a session management flaw [CWE-613] in the Apache Airflow Keycloak auth manager provider. The logout route revokes the presented token, but KeycloakJWTMiddleware issues a new, unrevoked token on the same HTTP response. The user remains authenticated after clicking logout, defeating the intended session termination.

Deployments using the Keycloak auth manager are affected. Any user with later access to the same browser session, such as on a shared workstation or kiosk, can continue to act as the previous user. Users of apache-airflow-providers-keycloak should upgrade to version 0.11.1 or later.

Critical Impact
Logout does not end the authenticated session, allowing session reuse on shared browsers and enabling unauthorized access to Airflow under the previous user's identity.

Affected Products

Apache Airflow deployments using apache-airflow-providers-keycloak
apache-airflow-providers-keycloak versions prior to 0.11.1
Shared or multi-user workstations accessing Airflow via Keycloak authentication

Discovery Timeline

2026-10-15 - CVE-2026-96806 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-96806

Vulnerability Analysis

The Apache Airflow Keycloak auth manager implements logout by revoking the token presented in the logout request. The revocation call succeeds server-side at Keycloak. However, KeycloakJWTMiddleware runs during the same response cycle and reissues a fresh JSON Web Token (JWT) attached to the outbound response.

The browser receives and stores the new token as if the user were still signed in. Subsequent requests present the newly issued token, which has not been revoked. The application treats the session as valid and continues to authorize actions under the original user identity.

The flaw falls under [CWE-613: Insufficient Session Expiration]. It does not require authentication to exploit because the attacker interacts with an existing browser session. Confidentiality impact is limited to data the previous user could access within Airflow.

Root Cause

The root cause is an ordering and lifecycle defect between two components. The logout handler and the JWT middleware operate independently on the same request. Logout invalidates the inbound token but does not signal the middleware to suppress token issuance for the response. The middleware's token refresh logic has no awareness that the session should be terminated.

Attack Vector

Exploitation requires physical or remote access to a browser where a legitimate user previously signed in and clicked logout. The attacker opens the Airflow interface and finds the session active under the prior user's identity. No credentials, phishing, or exploit payload is needed.

The scenario applies to shared workstations, library terminals, help-desk screen shares, and any environment where browser sessions persist across users. For technical details see the GitHub Pull Request for Airflow and the Apache Mailing List Thread.

Detection Methods for CVE-2026-96806

Indicators of Compromise

Airflow access logs showing user activity continuing after a /logout request from the same client IP and user agent
Multiple distinct JWT jti claims issued to the same browser session within seconds of a logout event
Keycloak token revocation events immediately followed by new token issuance for the same subject

Detection Strategies

Correlate Keycloak LOGOUT audit events with subsequent Airflow API requests bearing valid JWTs for the same user
Alert when a JWT is issued by KeycloakJWTMiddleware within the response to a /logout endpoint call
Monitor for session continuity patterns where logout actions are not followed by authentication challenges on the next page load

Monitoring Recommendations

Ingest Airflow webserver logs and Keycloak audit logs into a central SIEM for cross-source correlation
Track the version of apache-airflow-providers-keycloak installed across all Airflow deployments
Review shared-workstation access patterns and flag sessions reused across different physical users

How to Mitigate CVE-2026-96806

Immediate Actions Required

Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later across all Airflow deployments
Force logout of all active Airflow sessions and require re-authentication after the upgrade
Rotate Keycloak client secrets if session hijacking is suspected on shared endpoints

Patch Information

The fix is included in apache-airflow-providers-keycloak version 0.11.1. The patch modifies KeycloakJWTMiddleware to prevent token reissuance on logout responses. Review the GitHub Pull Request for Airflow and the OpenWall OSS-Security Discussion for implementation specifics.

Workarounds

Instruct users on shared workstations to fully close the browser after logging out of Airflow
Configure short JWT lifetimes in Keycloak to limit the window of session reuse
Restrict Airflow access to managed endpoints where single-user sessions can be enforced

bash

# Upgrade the Keycloak auth manager provider
pip install --upgrade 'apache-airflow-providers-keycloak>=0.11.1'

# Verify installed version
pip show apache-airflow-providers-keycloak | grep -i version

# Restart Airflow webserver to apply the updated middleware
airflow webserver --restart