A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may
    be captured during the Keycloak build process and embedded as default values in bytecode, leading to
    unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment
    variables during the build process is also stored as a default values, making it accessible during
    runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable
    due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all
    Keycloak versions up to 26.0.2. (CVE-2024-10451)

Keycloak versions installed prior to 24.0.9, 25.0 prior to 26.0.6 are affected by multiple vulnerabilities as referenced in the advisory.

  - Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS     enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user      or client that leverages mTLS as the authentication mechanism. (CVE-2024-10039)

  - If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS)     scenario by exhausting system resources due to a Regex complexity. (CVE-2024-10270)

  - A user with high privileges could read sensitive information from a Vault file that is not within the     expected context. This attacker must have previous high access to the Keycloak server in order to perform     resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will     only inform whether that file exists or not. (CVE-2024-10492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
465665	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-quarkus-server: security update to 24.0.9	Tenable Cloud Security	Echo Local Security Checks	Local	high
465665	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-quarkus-server: security update to 24.0.9	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
419159	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-v7gv-xpgf-6395)	Tenable Cloud Security	SCA Checks	Local	high
419159	SCA: security update for org.keycloak:keycloak-quarkus-server (GHSA-v7gv-xpgf-6395)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
212078	Keycloak < 24.0.9, 25.0.x < 26.0.6 Multiple Vulnerabilities	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2024-10451

high

Tenable Plugins

high

high

high

high

high