CVE-2026-40948

OVERVIEW CVE-2026-40948 is an authentication bypass vulnerability in apache-airflow-providers-keycloak that stems from improper OAuth 2.0 implementation. The vulnerable component fails to generate or validate the state parameter during login flows and does not implement PKCE (Proof Key for Code Exchange), security controls fundamental to OAuth 2.0. An attacker with legitimate access to the same Keycloak realm can exploit this flaw to perform login-CSRF or session fixation attacks, tricking victims into logging into attacker-controlled Airflow sessions where subsequently stored credentials can be harvested. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.4 (MEDIUM) with a network-based attack vector requiring minimal complexity and user interaction to trigger. The impact is limited to confidentiality and integrity breach with no availability impact. The low EPSS score of 0.000070000 suggests minimal prevalence in real-world exploitation relative to other CVEs. The Faucet risk score of 32/100 indicates moderate organizational risk, particularly in environments where Keycloak and Airflow integration stores sensitive connection credentials. EXPLOITATION STATUS There is no evidence of active exploitation, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities catalog and inactive status on the Hot List. No public exploit code is documented. The relatively low EPSS and risk scores suggest limited community attention. However, organizations using apache-airflow-providers-keycloak should prioritize upgrading to version 0.7.0 or later to close this authentication bypass vector before threat actors develop operational exploits.