Vulnerability in Keycloak
CVE-2025-9162
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process all…
EPSS: 0.000 (11.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Keycloak — versions 0
- Red Hat Build Of Keycloak 26.0 — versions 26.0.15-1, 26.0-18, 26.0-19
- Red Hat Build Of Keycloak 26.2 — versions 26.2.8-1, 26.2-8, 26.2.9-1
- Red Hat Build Of Keycloak 26.2.9
Weakness classification (CWE)
References
- RHSA-2025:15336 (vendor-advisory, x_refsource_REDHAT)
- RHSA-2025:15337 (vendor-advisory, x_refsource_REDHAT)
- RHSA-2025:15338 (vendor-advisory, x_refsource_REDHAT)
- RHSA-2025:15339 (vendor-advisory, x_refsource_REDHAT)
- RHSA-2025:16399 (vendor-advisory, x_refsource_REDHAT)
- RHSA-2025:16400 (vendor-advisory, x_refsource_REDHAT)
- access.redhat.com/security/cve/CVE-2025-9162 (vdb-entry, x_refsource_REDHAT)
- RHBZ#2389396 (issue-tracking, x_refsource_REDHAT)
Frequently asked questions
- What is CVE-2025-9162?
- CVE-2025-9162 is a medium-severity vulnerability in Keycloak, classified under CWE-526. CVSS score: 4.9/10. Published 2025-08-21.
- How severe is CVE-2025-9162?
- Medium severity. CVSS v3 base score is 4.9 out of 10.