product of apache

apache-airflow-providers-keycloak

2 thingsrelated by NVD

Severity

Being told

The feed says each thing that enters, leaves or changes; a reader adds its address, /zetlyn/trackers/cve/things.atom?q=…, to theirs.

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client… CVE-2026-76187	Severity critical
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token… CVE-2026-76186	Severity critical