CVE-2026-96806 Apache Software Foundation CVE debrief

Who should care

Deployments using the Keycloak auth manager in Apache Airflow should assess exposure and upgrade to apache-airflow-providers-keycloak 0.11.1 or later. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and its potential impact on their environments. They should verify user session management and plan for vendor-supported updates or mitigations through normal change control where exposure

Why it matters

CVE-2026-96806 allows continued user action after logout in Apache Airflow Keycloak auth manager deployments. Upgrades and session management reviews are recommended.

• Continued user action possible after logout via same browser session
• Upgrade required to fix vulnerability
• Verify user session management for affected deployments

Technical summary

The Apache Airflow Keycloak auth manager did not properly end user sessions on logout, allowing continued user action via the same browser session. This issue arises because the logout route revokes the presented token but `KeycloakJWTMiddleware` issues a new, unrevoked token on the same response. Deployments using the Keycloak auth manager are affected, and users of apache-airflow-providers-keycloak are recommended to upgrade to version 0.11.1 or later. This vulnerability enables an attacker with later access to the same browser to continue acting as that user without needing their login.

Defensive priority

Upgrade apache-airflow-providers-keycloak to 0.11.1 or later; review logout functionality for Keycloak auth manager deployments.

Recommended defensive actions

• Upgrade apache-airflow-providers-keycloak to 0.11.1 or later
• Review logout functionality for Keycloak auth manager deployments
• Verify user session management for affected deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry detail the vulnerability in Apache Airflow's Keycloak auth manager, describing how the auth manager fails to end sessions on logout. Limited information is available on exploitation or specific impact. The vulnerability allows continued user action after logout via the same browser session. Official CVE Program and NVD records provide source grounding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.