CVE Notifier

CVE-2026-76187 CWE-287 N/A

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowli…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-76186 CWE-565 N/A

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization dec…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-82310 CWE-613 N/A

Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to acce…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-86792 CWE-470 N/A

Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-86462 CWE-613 N/A

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's s…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-73463 CWE-362 5.3

Security Advisory 0169

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authen…

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-82311 CWE-613 N/A

Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login st…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-73445 CWE-20 4.9

Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This …

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-86465 CWE-639 N/A

Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containi…

cve.org Apache · Software · Foundation:Apache 16 Sep 2026

CVE-2026-92081 CWE-248 5.9

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer() and is served over HTTP/2, fastify unconditionally sets the Transfer-…

cve.org fastify:fastify 16 Sep 2026

CVE-2026-89792 CWE-? 7.1

ksmbd: prevent out-of-bounds reads in share config responses

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payload sizes before consuming variable-length fields. B…

cve.org Linux:Linux · Linux:Linux 16 Sep 2026

CVE-2026-2380 CWE-256 7.4

Security Advisory 0168

On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS dev…

cve.org Arista · Networks:EOS 16 Sep 2026