15984 matches found
Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8hxp-qmph-w5gq. This link is maintained to preserve external references. Original Description A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes...
CVE-2025-9162
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...
CVE-2025-9162
The CVE-2025-9162 issue affects Keycloak’s org.keycloak:keycloak-model-storage-service, where the KeycloakRealmImport custom resource substitutes placeholders in imported realm documents, potentially referencing environment variables. This substitution can enable injection of malicious content du...
CVE-2025-9162 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...
net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1, <=8.9), org.keycloak.testframework:keycloak-test-framework-clustering (>=26.3.0, <=26.3.3) +21 more potentially affected by CVE-2025-9162 via org.keycloak:keycloak-model-storage-services (>=26.3.0, <=26.3.3)
org.keycloak:keycloak-model-storage-services MAVEN version =26.3.0, =8.1, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.3 and more Source cves: CVE-2025-...
CVE-2025-9162 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...
Keycloak 安全漏洞
Keycloak is an open source identity and access management solution from Keycloak Open Source. A security vulnerability exists in Keycloak that stems from the possibility of injecting malicious content during placeholder substitution, which could lead to injection attacks...
CVE-2025-9162: Cleartext Storage of Sensitive Information in an Environment Variable
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...
PT-2025-34237
Name of the Vulnerable Software and Affected Versions: org.keycloak/keycloak-model-storage-service affected versions not specified Description: A flaw exists in the KeycloakRealmImport custom resource, which substitutes placeholders within imported realm documents, referencing environment...
MAL-2025-9143 Malicious code in @omisepayments/keycloak-react-components (npm)
The package @omisepayments/keycloak-react-components was found to contain malicious code...
MAL-2025-9238 Malicious code in @pmm/keycloak-factory (npm)
The package @pmm/keycloak-factory was found to contain malicious code...
CVE-2025-8916 vulnerabilities
Vulnerabilities for packages: kserve-modelmesh, druid, zipkin, thingsboard...
GHSA-PRJ3-CCX8-P6X4 vulnerabilities
Vulnerabilities for packages: apicurio-registry, strimzi-kafka-operator, wildfly, management-api-for-apache-cassandra-5.0, akhq, kserve-modelmesh, trino, flyway, celeborn, sonarqube, druid, keycloak, spark, tez, apache-nifi, thingsboard...
GHSA-4CX2-FC23-5WG6 vulnerabilities
Vulnerabilities for packages: kserve-modelmesh, druid, zipkin, thingsboard...
CVE-2025-55163 vulnerabilities
Vulnerabilities for packages: apicurio-registry, strimzi-kafka-operator, wildfly, management-api-for-apache-cassandra-5.0, akhq, kserve-modelmesh, trino, flyway, celeborn, sonarqube, druid, keycloak, spark, tez, apache-nifi, thingsboard...
CVE-2025-8916 vulnerabilities
Vulnerabilities for packages: camunda-zeebe, solr, kserve-modelmesh, zipkin, elasticsearch-fips, pinot-fips, kayenta, elasticsearch, pinot, kayenta-fips, druid, logstash, opensearch, neo4j, hadoop-fips, thingsboard...
CVE-2025-55163 vulnerabilities
Vulnerabilities for packages: trino, localstack, druid, kserve-modelmesh, strimzi-kafka-operator, elasticsearch, management-api-for-apache-cassandra-4.0, keycloak, celeborn, management-api-for-apache-cassandra-4.1, knative-kafka-broker, grpc-java-fips, apache-hop, akhq, apache-nifi,...
GHSA-4CX2-FC23-5WG6 vulnerabilities
Vulnerabilities for packages: camunda-zeebe, solr, kserve-modelmesh, zipkin, elasticsearch-fips, pinot-fips, kayenta, elasticsearch, pinot, kayenta-fips, druid, logstash, opensearch, neo4j, hadoop-fips, thingsboard...
GHSA-PRJ3-CCX8-P6X4 vulnerabilities
Vulnerabilities for packages: trino, localstack, druid, kserve-modelmesh, strimzi-kafka-operator, elasticsearch, management-api-for-apache-cassandra-4.0, keycloak, celeborn, management-api-for-apache-cassandra-4.1, knative-kafka-broker, grpc-java-fips, apache-hop, akhq, apache-nifi,...