CVE-2026-92228
Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
- Record
CVE-2026-92228- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2026-102520
The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
- Record
EUVD-2026-102520- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-79vw-4xm5-93ph No score
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`)...
The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
- Record
GHSA-79vw-4xm5-93ph- Weakness
- CWE-732
- Updated
- 2026-11-02
NVD
The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
- Record
CVE-2026-92228- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSV
Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.
Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
- Record
CVE-2026-92228- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-92228 is a medium vulnerability (CVSS 6.5) in Apache Software Foundation Airflow Keycloak Provider, published October 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.
References
github.com/apache/airflow/pull/73696
lists.apache.org/thread/b8wb6bogvnpfzo9do5w6d1lb8fxl5s79
openwall.com/lists/oss-security/2026/10/15/9
nvd.nist.gov/vuln/detail/CVE-2026-92228
pypi.python.org