CVE-2026-92228

Status: Awaiting AnalysisMedium (6.5)—

Severity6.5Medium · CVSS 3.1

Exploitation probability0.26 %higher than 16% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.

Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

CVSS

Base score: 6.5
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.26 %
Percentile among all scored CVEs: 16
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1213 Data from Information Repositoriescollection70 %

Vector AV:N/PR:L/UI:N con PR:L aplica T1210; el texto dice que cualquier miembro autenticado de un equipo lee eventos de auditoría de otros equipos, lo que encaja con T1213.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning User Training User Account Management Threat Intelligence Program Privileged Account Management Network Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Apache — Apache-airflow-providers-keycloak^AI

CWEs

CWE-732

References

Show 3 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-92228",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-92228",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T14:56:04.438922Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Airflow Keycloak provider",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.11.1",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:pypi/apache-airflow-providers-keycloak",
          "packageName": "apache-airflow-providers-keycloak",
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-15T22:21:11.410",
  "references": [
    {
      "url": "https://github.com/apache/airflow/pull/73696",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/b8wb6bogvnpfzo9do5w6d1lb8fxl5s79",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/15/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API.\n\nUsers of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later."
    }
  ],
  "lastModified": "2026-10-16T15:20:39.130",
  "sourceIdentifier": "security@apache.org"
}