Dashboard / CVE-2026-40948

CVE-2026-40948

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 61/100
Published: 2026-04-18 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Unchanged
C: Low
I: Low
A: None

Description

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
apache apache-airflow-providers-keycloak 0.0.1 – 0.7.0

References & Advisories (3)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.4 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.40%
Raw Score 0.004040
Percentile 34.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00404
2026-10-28
0.00404

Intelligence Sources

nvd ref →

External Links