CVE-2026-40948 Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

What is CVE-2026-40948?

CVE-2026-40948 is a medium-severity vulnerability in Apache Airflow Providers Keycloak, published on 18 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later.

Weakness: CWE-352

Which versions are affected by CVE-2026-40948?

3 open source packages ship an affected version, including apache-airflow-providers-keycloak. It affects 1 product.

Products include Apache Apache-Airflow-Providers-Keycloak.

How do I fix CVE-2026-40948?

Upgrade apache-airflow-providers-keycloak to 0.7.0 or later.

Is CVE-2026-40948 being exploited?

There is no known exploitation of CVE-2026-40948 in the wild and no public exploit code.

Other vulnerabilities in Apache Airflow Providers Keycloak

• CVE-2026-76187 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT Critical 9.8
• CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5w6h-pjw6-wvc6, PYSEC-2026-2369.