CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

<p>Posted by Vincent Beck on Sep 15</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before 0.10.0<br /> <br /> Description:<br /> <br /> Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user&apos;s identity from the signed <br /> Airflow session token but takes the Keycloa