CVE-2025-9162

Aug. 21, 2025, 4:15 p.m.

4.9
Medium

Description

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

Product(s) Impacted

Vendor Product Versions
Keycloak
  • Keycloak-model-storage-service
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-526
Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a keycloak keycloak-model-storage-service / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2025-9162
https://bugzilla.redhat.com/show_bug.cgi?id=2389396

Tags

secalert@redhat.com
CWE-526
2025-08-21
CVE-2025-9162

CVSS Score

4.9 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

    View Vector String

Timeline

Published: Aug. 21, 2025, 4:15 p.m.
Last Modified: Aug. 21, 2025, 4:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.