The Apache Airflow Keycloak provider contains a flaw that allows a user to remain authenticated even after requesting logout. When the logout endpoint revokes the presented token, the KeycloakJWTMiddleware component incorrectly issues a fresh, unrevoked token within the same response. Consequently, the browser continues to carry valid credentials, letting an attacker or another user who later accesses the same browser act as the original user. This flaw effectively bypasses the logout process without creating a new session, allowing unauthorized access to Airflow tasks and data.

Any deployment that uses the Apache Airflow Keycloak auth manager is affected. The vendor package Apache Airflow Keycloak provider (apache-airflow-providers-keycloak) before version 0.11.1 is vulnerable. Upgrading to version 0.11.1 or later mitigates the issue.

The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The flaw grants persistent authorized access on any workstation that retains the browser session after logout, making the vulnerability particularly dangerous in environments with shared or unattended terminals. The CVSS score of 5.8 indicates moderate severity, but the impact remains significant; any attack leading to session takeover can be leveraged for further exploitation of Airflow functionality. In the absence of explicit exploitation instructions, the attack vector is inferred to be local or remote via compromised browser sessions.