Claude Security Scans

Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity