CVE-2026-92228CWE-732

CVE-2026-92228

Medium · published October 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.

Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-10-16T02:21Z
References (3)
https://github.com/apache/airflow/pull/73696 · [email protected]https://lists.apache.org/thread/b8wb6bogvnpfzo9do5w6d1lb8fxl5s79 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/15/9 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 17 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 15 OCT 21:37Z
    Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
    cvelistv5
  • 15 OCT 21:37Z
    Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
    cvelistv5