CVE-2026-96806

Overview

Apache Airflow's Keycloak authentication manager fails to terminate sessions on logout, issuing a new token after revocation. This allows anyone who later accesses the same browser to continue acting as the logged-out user. The flaw affects deployments using the Keycloak auth manager.

Description

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

Impact

The vulnerability permits unauthorized users to maintain authenticated sessions, compromising confidentiality and integrity of user actions. Shared workstations or devices can be exploited to perform actions on behalf of the original user. Administrators must be aware that session revocation is ineffective until the provider is updated.

Remediation

Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later, which fixes the logout token handling. Verify that logout now clears all session tokens and that no new token is issued. As an interim measure, restrict shared workstation usage or enforce browser logout and cookie clearing.

Risk context

Severity is medium (CVSS 6.5). While no EPSS data is available, the flaw can enable session hijacking on shared environments, warranting prompt patching to prevent unauthorized actions.

Affected products

• Apache Airflow
• apache-airflow-providers-keycloak