Improper input validation in Red Hat keycloak
Priority MEDIUM 43CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 12 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
Why it matters now
EPSS 0.02604 85th percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-core (Maven): 11.0.0org.keycloak:keycloak-common (Maven): 11.0.0Red Hat: 9 advisoriesRed Hat: 12 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | keycloak | before 11.0.0 | 11.0.0 | Patch available | CNA |
| — | org.keycloak:keycloak-core (Maven) | before 11.0.0 | 11.0.0 | Patch available | GHSA-m6mm-q862-j366 |
| — | org.keycloak:keycloak-common (Maven) | before 11.0.0 | 11.0.0 | Patch available | GHSA-m6mm-q862-j366 |
- keycloak VendorRed Hat Affected before 11.0.0 Fixed in 11.0.0 Patch available CNA
- org.keycloak:keycloak-core (Maven) Vendor— Affected before 11.0.0 Fixed in 11.0.0 Patch available GHSA-m6mm-q862-j366
- org.keycloak:keycloak-common (Maven) Vendor— Affected before 11.0.0 Fixed in 11.0.0 Patch available GHSA-m6mm-q862-j366
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* | before 11.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | up to 1.4.2 | Vulnerable | quarkusio |
- cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 11.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.4.2 Vulnerable ·quarkusio
Remediation
- Fix · GHSA-m6mm-q862-j366 org.keycloak:keycloak-core (Maven) Fixed in 11.0.0 Advisory →
- Fix · GHSA-m6mm-q862-j366 org.keycloak:keycloak-common (Maven) Fixed in 11.0.0 Advisory →
Red Hat 9 advisories
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
- RHSA-2020:4252 Released 2020-10-14 · Red Hat rating ImportantRed Hat build of Quarkus 1.7.5 release and security update
- Red Hat build of Quarkus 1.7.5
- RHSA-2020:3678 Released 2020-09-08 · Red Hat rating ImportantRed Hat Process Automation Manager 7.8.1 Security Update
- Red Hat Process Automation 7
Show 6 more Red Hat advisories
- RHSA-2020:3675 Released 2020-09-08 · Red Hat rating ImportantRed Hat Decision Manager 7.8.1 Security Update
- Red Hat Decision Manager 7
- RHSA-2020:3017 Released 2020-07-27 · Red Hat rating ImportantRed Hat support for Spring Boot 2.1.15 security and bug fix update
- Red Hat Runtimes Spring Boot 2.1.15
- RHSA-2020:2905 Released 2020-07-23 · Red Hat rating ImportantRed Hat build of Thorntail 2.7.0 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:2816 Released 2020-07-02 · Red Hat rating ImportantRH-SSO 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server keycloak-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el6, keycloak-saml-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el6
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server keycloak-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el7, keycloak-saml-adapter-sso7_4-eap6-9.0.4-1.redhat_00001.1.ep6.el7
- RHSA-2020:2814 Released 2020-07-02 · Red Hat rating ImportantRH-SSO 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-keycloak-adapter-sso7_4-9.0.4-1.redhat_00001.1.el8eap, eap7-keycloak-saml-adapter-sso7_4-9.0.4-1.redhat_00001.1.el8eap
- Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-keycloak-adapter-sso7_4-9.0.4-1.redhat_00001.1.el6eap, eap7-keycloak-saml-adapter-sso7_4-9.0.4-1.redhat_00001.1.el6eap
- Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-keycloak-adapter-sso7_4-9.0.4-1.redhat_00001.1.el7eap, eap7-keycloak-saml-adapter-sso7_4-9.0.4-1.redhat_00001.1.el7eap
- RHSA-2020:2813 Released 2020-07-02 · Red Hat rating ImportantRed Hat Single Sign-On 7.4.1 security update
- Red Hat Single Sign-On 7.4.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix yet |
| Red Hat Decision Manager 7 | Fixed | RHSA-2020:3675 |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
| Red Hat JBoss EAP 7.3 for BaseOS-8 | Fixed | RHSA-2020:2814 |
| Red Hat JBoss EAP 7.3 for RHEL 6 Server | Fixed | RHSA-2020:2814 |
| Red Hat JBoss EAP 7.3 for RHEL 7 Server | Fixed | RHSA-2020:2814 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server | Fixed | RHSA-2020:2816 |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server | Fixed | RHSA-2020:2816 |
| Red Hat Process Automation 7 | Fixed | RHSA-2020:3678 |
| Red Hat Runtimes Spring Boot 2.1.15 | Fixed | RHSA-2020:3017 |
| Red Hat Single Sign-On 7.4.1 | Fixed | RHSA-2020:2813 |
| Red Hat build of Quarkus 1.7.5 | Fixed | RHSA-2020:4252 |
| Text-Only RHOAR | Fixed | RHSA-2020:2905 |
Not affected: 1 product
- Red Hat Mobile Application Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1714
- 2026-10-03 Alias added: GHSA-m6mm-q862-j366
References
More Red Hat Decision Manager vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2019-11045 Insufficiently protected credentials in Business-central CVSS 3.1HIGH 7.5
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2020-1714 · CVE Program
- CVE-2020-1714 · NVD
- FIRST EPSS
- GHSA-m6mm-q862-j366 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1714 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences