The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs.
The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Red Hat, Apache Software Foundation
- Product
- Keycloak / Single Sign-On, Airflow, Java libraries / app servers
- Exposure class
- Identity, Developer platform, Web platform
Why it ranks 12 (Routine)
- Exposed product class: identity
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-92228 on this site · NVD · CVE.org · Vulnpedia