A critical authentication bypass in the Apache Airflow Keycloak provider enables unauthorized access to Airflow sessions by leveraging credentials from unrelated confidential clients sharing the same realm.

The vulnerability is an improper authentication flaw (CWE-287) where the unauthenticated token endpoint fails to restrict client IDs to the specific instance configured for Airflow. An attacker can use credentials from any confidential client within the Keycloak realm to successfully authenticate and receive a valid, signed Airflow session token.

Successful exploitation allows an attacker to gain unauthorized access to the Airflow environment, potentially leading to total system compromise depending on the privileges assigned to the intercepted service account. Given the CVSS score of 9.8, this vulnerability poses a severe risk to organizational data integrity, confidentiality, and service availability, as it facilitates unauthorized administrative actions without requiring specific Airflow credentials.

Immediate Action: Upgrade the Apache Airflow Keycloak provider to version 0.10.0 or later to implement strict client validation and prevent unauthorized token issuance.

Proactive Monitoring: Review Keycloak and Airflow authentication logs for unusual login patterns or service account activity that deviates from expected baseline behavior.

Compensating Controls: If immediate patching is not feasible, consider isolating the Keycloak realm used for Airflow to ensure it does not share confidential clients with other applications, thereby limiting the scope of potential credential misuse.

Public Exploit Available: No

This vulnerability represents a significant security risk due to its critical severity and the ease with which an attacker can bypass authentication mechanisms. Organizations using the Keycloak provider for Apache Airflow must prioritize updating to version 0.10.0 immediately to remediate this flaw and prevent potential unauthorized access to their orchestration pipelines.