Skip to main content

Exposure of Sensitive Information Through Environmental Variables

CVE-2025-9162

Medium
4.9/10

Summary

A flaw was found in the package org.keycloak:keycloak-model-storage-services. The "KeycloakRealmImport" custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • NONE

CWE-526 - Exposure of Sensitive Information Through Environmental Variables

Environmental variables may contain sensitive information about a remote server.

References

Advisory Timeline

  • Published