A critical vulnerability in the Apache Airflow Keycloak provider allows an attacker to perform unauthorized actions by pairing their own session with a stolen Keycloak token.

This flaw stems from a lack of integrity checking between the Airflow session token and the Keycloak authorization cookies. An attacker with a valid Airflow account can use a third party Keycloak token to inherit the privileges of that foreign subject, while maintaining their own session identity for auditing purposes.

The vulnerability poses a severe risk to organizational data integrity and access control, as it enables privilege escalation and unauthorized operations within the Airflow environment. Given the CVSS score of 9.1, this flaw is categorized as critical because it allows an attacker to bypass standard authentication boundaries and perform actions on behalf of other users, potentially leading to widespread unauthorized data access or system configuration changes.

Immediate Action: Upgrade the Apache Airflow Keycloak provider to version 0.10.0 or later to ensure proper binding between session identities and Keycloak tokens.

Proactive Monitoring: Review audit logs for unusual patterns where user activity appears to originate from mismatched session and Keycloak token subjects.

Compensating Controls: While no specific WAF rule can fully mitigate this logic flaw, ensure that Keycloak tokens are handled over secure, encrypted channels and limit exposure of the Airflow management interface to trusted networks.

Public Exploit Available: false

This vulnerability represents a significant security oversight in the authentication logic of the affected Airflow component. Organizations currently running version 3.3 or later of Apache Airflow with the Keycloak auth manager should prioritize the update to version 0.10.0 immediately. Failure to apply this patch leaves the system susceptible to identity impersonation and unauthorized administrative actions.