Executive brief
The Apache Airflow Keycloak authentication provider fails to validate that client credentials belong to the configured Airflow client, allowing any confidential client registered in the same Keycloak realm to obtain valid Airflow session tokens. An attacker with credentials for any unrelated application sharing the realm can authenticate to Airflow and access resources based on that application's service account permissions, plus any endpoints that only require authentication rather than specific authorization checks.
Technical details
The vulnerability is an authentication bypass in the Keycloak provider's token endpoint, which accepts client_credentials grant requests without validating that the supplied client_id matches the Airflow-configured client. The root cause is the absence of an allowlist or validation check that restricts which client identifiers may authenticate via this endpoint. An unauthenticated attacker can submit valid credentials from any confidential client in the shared Keycloak realm and receive a signed session token minted in the context of that service account. While per-resource authorization checks are still enforced, the attack enables privilege escalation within the scope of the compromised service account and may bypass authentication-only gated endpoints. The fix in version 0.10.0 enforces validation to accept only the configured client on the grant.
Affected products
- Apache Airflow Keycloak Provider prior to 0.10.0
Timeline
- 2026-09-16: disclosed
- 2026-08-28: patched: Fix merged in upstream Apache Airflow PR #72205