CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

<p>Posted by Vincent Beck on Sep 15</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0.10.0<br /> <br /> Description:<br /> <br /> Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any <br /> confidential client registered in the Keycloak realm,