# CVE-2026-76186: Apache Airflow Keycloak provider session token binding bypass

Source: https://junglewise.ai/threats/cve-2026-76186-apache-airflow-keycloak-provider-session-token-binding-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76186 · Severity: critical · CVSS 9.1 · Published 2026-09-16

Apache Airflow's Keycloak authentication provider (version 3.3+) uses signed session tokens to identify users but stores Keycloak access and refresh tokens in separate unsigned cookies without verifying they belong to the same user. An attacker with any valid Airflow login can pair it with a victim's Keycloak token obtained through other means, allowing them to execute actions with the victim's Keycloak permissions while audit logs record the attacker's identity. This vulnerability could enable unauthorized access to protected resources and data manipulation across systems authenticated via Keycloak.

Technologies: [Apache Airflow](https://junglewise.ai/threats/technologies/airflow). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-76186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76186 being exploited in the wild.

**How severe is CVE-2026-76186?** Critical severity, with a CVSS score of 9.1, published 16 September 2026.

**Which products and versions are affected?** Apache Airflow 3.3 and later.

**Is there a fix for CVE-2026-76186?** A patch was published on 2026-08-29: Fix merged in apache/airflow PR #72207 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76186 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76186?** Check whether you run Apache Airflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a session token binding failure in Apache Airflow's Keycloak auth manager. The root cause: Keycloak access and refresh tokens moved from inside the signed Airflow session token to separate, unauthenticated cookies in Airflow 3.3+, but the code never validates that these cookies describe the same subject as the signed session token. An attacker holding a valid Airflow session can inject a different user's Keycloak token via cookies; authorization decisions use the foreign token (granting foreign privileges), while session identity and audit logs show the attacker's account. The refresh flow re-issues session tokens carrying the mismatched pairing, persisting across sessions. Attack requires network access to Airflow and possession of another user's Keycloak tokens (obtained out-of-band) plus the attacker's own valid login. The fix (apache-airflow-providers-keycloak 0.10.0+) verifies that cookie-supplied tokens' `sub` claim matches the session identity before use.

## Affected products

- Apache Airflow 3.3 and later
- Apache apache-airflow-providers-keycloak before 0.10.0

## Timeline

- 2026-09-16: disclosed
- 2026-08-29: patched: Fix merged in apache/airflow PR #72207

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://github.com/apache/airflow/pull/72207](https://github.com/apache/airflow/pull/72207)

## Related threats

- [Apache Airflow incomplete deserialization check bypass in scheduler](https://junglewise.ai/threats/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-that-checks-the-scheduler)
- [Apache Airflow scheduler XCom deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-86829-apache-airflow-s-scheduler-fully-deserializes-xcom-values-written)
- [Apache Airflow CLI audit log secrets exposure](https://junglewise.ai/threats/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but)
- [Apache Airflow unsafe deserialization in deadline alert fields](https://junglewise.ai/threats/cve-2026-82337-apache-airflow-rebuilt-deadline-alert-fields-through-generic)
- [Apache Airflow Task SDK secret cache key collision in multi-team deployments](https://junglewise.ai/threats/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the)