Executive brief
The Keycloak authentication component for Apache Airflow fails to properly secure the login process, allowing for a session fixation attack. An attacker can trick a user into logging into the attacker's session; if the user then enters sensitive credentials into Airflow, the attacker can steal them. This could lead to the theft of corporate database or service credentials managed within the Airflow platform.
Technical details
The Keycloak authentication manager in `apache-airflow-providers-keycloak` (versions 0.0.1 to 0.6.x) does not generate or validate the OAuth 2.0 `state` parameter during the login/callback flow and lacks PKCE support. This vulnerability allows a remote attacker to perform a login-CSRF or session fixation attack. By delivering a crafted callback URL to a victim, the attacker can force the victim's browser to authenticate into an Airflow session controlled by the attacker. If the victim subsequently adds or modifies credentials in Airflow Connections while in this session, the attacker can harvest those credentials. The issue is resolved in version 0.7.0.
Affected products
- Apache Software Foundation Airflow Keycloak Provider (apache-airflow-providers-keycloak) 0.0.1 before 0.7.0
Timeline
- 2026-03-23: patched: Fix merged in GitHub pull request #64114
- 2026-04-17: disclosed: Public disclosure on oss-security mailing list
- 2026-04-18: advisory: CVE published to NVD