The vulnerability allows any client registered in the Keycloak realm to use its credentials at the Airflow token endpoint, resulting in the issuance of a signed Airflow session JWT. This bypasses the intended restriction that only the Airflow client should be able to obtain an Airflow session. Attackers who possess valid credentials for another confidential client can therefore acquire an authenticated Airflow session with the authority of that client, enabling them to perform actions allowed to that service account and to any endpoints that require authentication. The weakness manifests as an authentication bypass (CWE-287).

The issue arises in deployments of Apache Airflow that use the Keycloak authentication provider where the Keycloak realm is shared with other confidential clients. It specifically affects installations of the apache-airflow-providers-keycloak package before version 0.10.0. Systems using older versions of this provider with a shared Keycloak realm and non-Airflow confidential clients are vulnerable.

Exploitation requires only valid credentials for a non-Airflow client in the same Keycloak realm. The attack is performed by sending a client‑credentials grant to the Airflow token endpoint, which will respond without authentication. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 9.8 marks severe risk. Given the lack of a public exploit yet, the immediate risk depends on the exposure of non‑Airflow client credentials. Nonetheless, the ability to forge an Airflow session token is a high‑impact authentication bypass.