Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

apache-airflow-providers-keycloak

3 known vulnerabilities (2 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release
0.11.2 (Oct 24, 2026): no advisory affects it
Newest unaffected release
0.11.2 (Oct 24, 2026), the latest release
Advisories
3 · 2 critical, 1 medium
Weekly downloads
25.2K
Dependents
0
Releases
49 since 0.0.1 (Aug 17, 2025)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-76187Critical 9.8

    Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

    Affected: fixed in 0.10.0.

    Fixed in 0.10.0 (released Sep 14, 2026, 2 days before disclosure).

    The latest release, 0.11.2, is not affected.

  • CVE-2026-76186Critical 9.1

    Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

    Affected: fixed in 0.10.0.

    Fixed in 0.10.0 (released Sep 14, 2026, 2 days before disclosure).

    The latest release, 0.11.2, is not affected.

  • CVE-2026-40948Medium 5.4

    Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager

    Affected: from 0.0.1, fixed in 0.7.0; from 0.0.1, fixed in 0.7.0.

    Fixed in 0.7.0 (released Mar 28, 2026, 21 days before disclosure).

    The latest release, 0.11.2, is not affected.