Unrated severityNVD Advisory· Published Oct 15, 2026

CVE-2026-92228

Description

The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.

Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Airflowllm-fuzzy
Range: >=0.11.1
Apache/Apache Airflow Providers Keycloakllm-fuzzy
Range: >=0.11.1

Patches

Vulnerability mechanics

References

github.com/apache/airflow/pull/73696nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000