A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource
    substitutes placeholders within imported realm documents, potentially referencing environment variables.
    This substitution process allows for injection attacks when crafted realm documents are processed. An
    attacker can leverage this to inject malicious content during the realm import procedure. This can lead to
    unintended consequences within the Keycloak environment. (CVE-2025-9162)

The version of Keycloak installed on the remote host is prior or equal to 26.3.3. It is, therefore, affected by code injection vulnerability as reference in GHSA-w2wj-hw98-233h advisory.

  - A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource     substitutes placeholders within imported realm documents, potentially referencing environment variables.     This substitution process allows for injection attacks when crafted realm documents are processed. An     attacker can leverage this to inject malicious content during the realm import procedure. This can lead     to unintended consequences within the Keycloak environment. (CVE-2025-9162)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
457769	Echo: org.keycloak:keycloak-model-storage-services: security update to 26.3.4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457769	Echo: org.keycloak:keycloak-model-storage-services: security update to 26.3.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
435541	SCA: security update for org.keycloak:keycloak-model-storage-services (GHSA-8hxp-qmph-w5gq)	Tenable Cloud Security	SCA Checks	Local	medium
435541	SCA: security update for org.keycloak:keycloak-model-storage-services (GHSA-8hxp-qmph-w5gq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
256694	Keycloak <= 26.3.3 Code Injection (GHSA-w2wj-hw98-233h)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-9162

medium

Tenable Plugins

medium

medium

medium

medium

medium