{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-76187 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-76187 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-76187 is a critical authentication bypass vulnerability in Apache Airflow Keycloak provider, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-76187 and fix it if it is affected.\n\nWhat it is: CVE-2026-76187 is a critical authentication bypass vulnerability in Apache Airflow Keycloak provider, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-76187 in the wild and no public exploit code.\n\nAffected product: Apache Airflow Keycloak provider. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-76187/ (Markdown: https://insights.sbomify.com/CVE-2026-76187/index.md)","id":"CVE-2026-76187","markdown":"https://insights.sbomify.com/CVE-2026-76187/index.md","name":"CVE-2026-76187","record":{"aliases":["GHSA-rwpr-5hxh-f9cm"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["privilege_escalation","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Airflow Keycloak provider","requires_auth":"none","summary":"Attackers with credentials for any Keycloak realm client can authenticate to Airflow, bypassing intended client restrictions and gaining unauthorized access.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"apache-airflow-providers-keycloak","vendor":"apache"}],"cvss":{"score":9.8,"severity":"critical","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"description":"Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an unrelated application that happens to share the realm are valid Airflow login credentials, and Airflow mints a signed session token for that application's service account. The endpoint also answers unauthenticated credential guesses against Keycloak under Airflow's identity.\n\nAffects deployments using the Keycloak auth manager whose realm is shared with other confidential clients. The attacker needs valid credentials for any one of those clients, not for Airflow. Resource authorization is still evaluated per subject, so the access gained is whatever that service account holds, plus any endpoint gated only on being authenticated.\n\nUsers of apache-airflow-providers-keycloak are recommended to upgrade to version 0.10.0 or later, which accepts only the configured client on that grant.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT","id":"CVE-2026-76187","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)","id":"CVE-2026-76189"},"packages":[],"prev":{"headline":"Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity","id":"CVE-2026-76186"},"products":["Apache Airflow Keycloak provider"],"published":"2026-09-16","related":[{"cvss_score":9.1,"headline":"Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity","id":"CVE-2026-76186","kev_date_added":null,"published":"2026-09-16"},{"cvss_score":5.4,"headline":"Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager","id":"CVE-2026-40948","kev_date_added":null,"published":"2026-04-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-09-17","vendors":["Apache Software Foundation"]},"summary":"Attackers with credentials for any Keycloak realm client can authenticate to Airflow, bypassing intended client restrictions and gaining unauthorized access.","url":"https://insights.sbomify.com/CVE-2026-76187/"}