TI-2024-10881 Aliases CVE-2024-11736 GHSA-f4v7-3mww-9gc2

Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

LOW 24CWE-526Published 2025-01-14 · Updated 2026-08-31

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00755 55th percentileScored 2026-11-07

Fix Partial keycloak: 26.0.8org.keycloak:keycloak-quarkus-server (Maven): 26.0.8Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	keycloak	before 26.0.8	26.0.8	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.0	—	26.0.8-1	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.0	—	26.0-7	Patch available	CNA
Red Hat	Red Hat build of Keycloak 26.0	—	26.0-8	Patch available	CNA
Red Hat	RHBK 26.0.8	—	—	Not affected	CNA
Red Hat	Red Hat Build of Keycloak	—	—	No fix listed	CNA
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—	—	Not affected	CNA
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—	—	Not affected	CNA
—	org.keycloak:keycloak-quarkus-server (Maven)	before 26.0.8	26.0.8	Patch available	GHSA-f4v7-3mww-9gc2

keycloak Vendor— Affected before 26.0.8 Fixed in 26.0.8 Patch available CNA
Red Hat build of Keycloak 26.0 VendorRed Hat Affected — Fixed in 26.0.8-1 Patch available CNA
Red Hat build of Keycloak 26.0 VendorRed Hat Affected — Fixed in 26.0-7 Patch available CNA
Red Hat build of Keycloak 26.0 VendorRed Hat Affected — Fixed in 26.0-8 Patch available CNA
RHBK 26.0.8 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
org.keycloak:keycloak-quarkus-server (Maven) Vendor— Affected before 26.0.8 Fixed in 26.0.8 Patch available GHSA-f4v7-3mww-9gc2

CPE names CNA · 5

CPE	Versions	Role	Vendor
cpe:/a:redhat:build_keycloak:26.0::el9	26.0	—	Red Hat
cpe:/a:redhat:build_keycloak:26.0	26.0	—	Red Hat
cpe:/a:redhat:build_keycloak:	—	—	Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform:8	8	—	Red Hat
cpe:/a:redhat:jbosseapxp	—	—	Red Hat

cpe:/a:redhat:build_keycloak:26.0::el9 Versions 26.0 — ·Red Hat
cpe:/a:redhat:build_keycloak:26.0 Versions 26.0 — ·Red Hat
cpe:/a:redhat:build_keycloak: Versions — — ·Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform:8 Versions 8 — ·Red Hat
cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat

Remediation

Fix · CNA keycloak Fixed in 26.0.8
Fix · GHSA-f4v7-3mww-9gc2 org.keycloak:keycloak-quarkus-server (Maven) Fixed in 26.0.8 Advisory →

Red Hat 2 advisories

RHSA-2025:0299 Released 2025-01-13 · Red Hat rating Moderate
Red Hat build of Keycloak 26.0.8 Images Update
- Red Hat build of Keycloak 26.0 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
RHSA-2025:0300 Released 2025-01-13 · Red Hat rating Moderate
Red Hat build of Keycloak 26.0.8 Update
- RHBK 26.0.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2025-01-14
Red Hat RHBK 26.0.8, Red Hat Build of Keycloak and 3 more products — RHSA-2025:0299
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-10880 Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersPriority LOW 31
Show all 2 records → Advisory →
Advisory · 2025-01-14
Red Hat RHBK 26.0.8, Red Hat Build of Keycloak and 3 more products — RHSA-2025:0300
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-10880 Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headersPriority LOW 31
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Build of Keycloak	Affected	No fix planned: Will not fix
RHBK 26.0.8	Fixed	RHSA-2025:0300
Red Hat build of Keycloak 26.0	Fixed	RHSA-2025:0299

Not affected: 2 products

Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

2026-10-02 Threatist record created from CVE-2024-11736
2026-10-03 Alias added: GHSA-f4v7-3mww-9gc2

References

Advisory 3

Other 5

TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8

See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences