CVE-2026-92228 Apache Software Foundation CVE debrief

Who should care

Defenders and administrators of Apache Airflow deployments with multi-team mode enabled and Keycloak auth manager should assess exposure and prioritize upgrading to apache-airflow-providers-keycloak version 0.11.1 or later.

Why it matters

CVE-2026-92228 allows authenticated members of one team to read other teams' audit events in Apache Airflow deployments with multi-team mode and Keycloak auth manager enabled. Defenders should prioritize upgrading to apache-airflow-providers-keycloak version 0.11.1 or later.

• Potential unauthorized access to audit logs by authenticated team members
• Possible exposure of sensitive information in audit events
• Need for verification of current apache-airflow-providers-keycloak version
• Priority on upgrading to version 0.11.1 or later for remediation

Technical summary

The Apache Airflow Keycloak provider's multi-team provisioning feature granted every team role global read access to audit logs. This vulnerability allows authenticated members of one team to read other teams' audit events through the UI or event-log API in Apache Airflow deployments with multi-team mode and Keycloak auth manager enabled. The issue arises from the provider's implementation of the _attach_team_permissions function. Users of apache-airflow-providers-keycloak are recommended to upgrade to version 0.11.1 or later.

Defensive priority

Defenders should prioritize upgrading apache-airflow-providers-keycloak to version 0.11.1 or later to prevent unauthorized access to audit logs.

Recommended defensive actions

• Upgrade apache-airflow-providers-keycloak to version 0.11.1 or later
• Review and restrict access to audit logs
• Monitor for unauthorized access to audit events
• Verify current apache-airflow-providers-keycloak version in use
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source references indicate that the Apache Airflow Keycloak provider's multi-team provisioning feature granted global read access to audit logs for every team role. However, details about the number of affected deployments or specific exploitation instances are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.