Read the docs
TI-2024-09679 Aliases CVE-2024-10451GHSA-v7gv-xpgf-6395

Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process

Priority LOW 28CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-798.

Summary

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00925 60th percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-quarkus-server (Maven): 24.0.9, 26.0.6Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Keycloak 24—24.0.9-1Patch availableCNA
Red HatRed Hat build of Keycloak 24—24-18Patch availableCNA
Red HatRed Hat build of Keycloak 24—24-18Patch availableCNA
Red HatRed Hat build of Keycloak 24.0.9——Not affectedCNA
Red HatRed Hat build of Keycloak 26.0—26.0.6-2Patch availableCNA
Red HatRed Hat build of Keycloak 26.0—26.0-5Patch availableCNA
Red HatRed Hat build of Keycloak 26.0—26.0-6Patch availableCNA
Red HatRed Hat build of Keycloak 26.0.6——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 8——Not affectedCNA
Red HatRed Hat Single Sign-On 7——No fix listedCNA
—org.keycloak:keycloak-quarkus-server (Maven)before 24.0.924.0.9Patch availableGHSA-v7gv-xpgf-6395
—org.keycloak:keycloak-quarkus-server (Maven)25.0.0 to before 26.0.626.0.6Patch availableGHSA-v7gv-xpgf-6395
  • Red Hat build of Keycloak 24 VendorRed Hat Affected — Fixed in 24.0.9-1 Patch available CNA
  • Red Hat build of Keycloak 24 VendorRed Hat Affected — Fixed in 24-18 Patch available CNA
  • Red Hat build of Keycloak 24 VendorRed Hat Affected — Fixed in 24-18 Patch available CNA
  • Red Hat build of Keycloak 24.0.9 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.0 VendorRed Hat Affected — Fixed in 26.0.6-2 Patch available CNA
  • Red Hat build of Keycloak 26.0 VendorRed Hat Affected — Fixed in 26.0-5 Patch available CNA
  • Red Hat build of Keycloak 26.0 VendorRed Hat Affected — Fixed in 26.0-6 Patch available CNA
  • Red Hat build of Keycloak 26.0.6 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • org.keycloak:keycloak-quarkus-server (Maven) Vendor— Affected before 24.0.9 Fixed in 24.0.9 Patch available GHSA-v7gv-xpgf-6395
  • org.keycloak:keycloak-quarkus-server (Maven) Vendor— Affected 25.0.0 to before 26.0.6 Fixed in 26.0.6 Patch available GHSA-v7gv-xpgf-6395

CPE names CNA · 6

CPEVersionsRoleVendor
cpe:/a:redhat:build_keycloak:24::el924—Red Hat
cpe:/a:redhat:build_keycloak:2424—Red Hat
cpe:/a:redhat:build_keycloak:26.0::el926.0—Red Hat
cpe:/a:redhat:build_keycloak:26.026.0—Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform:88—Red Hat
cpe:/a:redhat:red_hat_single_sign_on:77—Red Hat
  • cpe:/a:redhat:build_keycloak:24::el9 Versions 24 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:24 Versions 24 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.0::el9 Versions 26.0 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.0 Versions 26.0 — ·Red Hat
  • cpe:/a:redhat:jboss_enterprise_application_platform:8 Versions 8 — ·Red Hat
  • cpe:/a:redhat:red_hat_single_sign_on:7 Versions 7 — ·Red Hat

Remediation

  • Fix · GHSA-v7gv-xpgf-6395 org.keycloak:keycloak-quarkus-server (Maven) Fixed in 24.0.9 Advisory →
  • Fix · GHSA-v7gv-xpgf-6395 org.keycloak:keycloak-quarkus-server (Maven) Fixed in 26.0.6 Advisory →

Red Hat 4 advisories

  • RHSA-2024:10178 Released 2024-11-21 · Red Hat rating Important
    Red Hat build of Keycloak 26.0.6 Update
    • Red Hat build of Keycloak 26.0.6
  • RHSA-2024:10177 Released 2024-11-21 · Red Hat rating Important
    Red Hat build of Keycloak 26.0.6 Images Update
    • Red Hat build of Keycloak 26.0 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2024:10176 Released 2024-11-21 · Red Hat rating Important
    Red Hat build of Keycloak 24.0.9 Update
    • Red Hat build of Keycloak 24.0.9
Show 1 more Red Hat advisories
  • RHSA-2024:10175 Released 2024-11-21 · Red Hat rating Important
    Red Hat build of Keycloak 24.0.9 Images Update
    • Red Hat build of Keycloak 24 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 and 4 more products — RHSA-2024:10175

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2024-09516 Org.keycloak:keycloak-services: keycloak denial of servicePriority LOW 31
    • TI-2024-08968 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityPriority LOW 22
    • TI-2024-09718 Keycloak-quarkus-server: keycloak path trasversalPriority LOW 15
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 and 4 more products — RHSA-2024:10176

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2024-09516 Org.keycloak:keycloak-services: keycloak denial of servicePriority LOW 31
    • TI-2024-08968 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityPriority LOW 22
    • TI-2024-09718 Keycloak-quarkus-server: keycloak path trasversalPriority LOW 15
    Show all 4 records → Advisory →
Show 2 more groups
  • Advisory ·

    Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 and 4 more products — RHSA-2024:10177

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2024-09516 Org.keycloak:keycloak-services: keycloak denial of servicePriority LOW 31
    • TI-2024-08968 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityPriority LOW 22
    • TI-2024-09718 Keycloak-quarkus-server: keycloak path trasversalPriority LOW 15
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 and 4 more products — RHSA-2024:10178

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2024-09516 Org.keycloak:keycloak-services: keycloak denial of servicePriority LOW 31
    • TI-2024-08968 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityPriority LOW 22
    • TI-2024-09718 Keycloak-quarkus-server: keycloak path trasversalPriority LOW 15
    Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Keycloak 24Fixed RHSA-2024:10175
Red Hat build of Keycloak 24.0.9Fixed RHSA-2024:10176
Red Hat build of Keycloak 26.0Fixed RHSA-2024:10177
Red Hat build of Keycloak 26.0.6Fixed RHSA-2024:10178
Not affected: 1 product
  • Red Hat JBoss Enterprise Application Platform 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10451
  2. 2026-10-03 Alias added: GHSA-v7gv-xpgf-6395

References

Advisory 5

Other 5

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences