Apache Software Foundation Apache Airflow Keycloak provider

• CVE-2026-96806 Medium 5.8 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token 0.4%
• CVE-2026-92228 Medium 6.5 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read 0.3%
• CVE-2026-76187 Critical 9.8 Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT 1.0%
• CVE-2026-76186 Critical 9.1 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity 0.8%