Log in Start free

Vulnerability · Published Aug 21, 2025 · Assigned by redhat

CVE-2025-9162Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

Medium 4.9

In plain English

A medium-severity security flaw in keycloak from Keycloak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-model-storage-servicesno fix listedGHSA-8hxp-qmph-w5gq
Mavenorg.keycloak:keycloak-model-storage-services26.3.4GHSA-8hxp-qmph-w5gq

Affected products (as reported)

VendorProductVersions
Keycloak keycloak 0 – before 26.3.4
Red Hat Red Hat build of Keycloak 26.0 see references
Red Hat Red Hat build of Keycloak 26.0 see references
Red Hat Red Hat build of Keycloak 26.0 see references
Red Hat Red Hat build of Keycloak 26.0 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2.9 see references

Weakness: CWE-526 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References