CVE-2025-11538: Keycloak-server: debug default bind address
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Other sources
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Red Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network. Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11538?
CVE-2025-11538 is considered a critical vulnerability due to the potential exposure of the JDWP port to local network attackers.
How do I fix CVE-2025-11538?
To mitigate CVE-2025-11538, avoid using debug mode or limit JDWP binding to localhost instead of 0.0.0.0.
What systems are affected by CVE-2025-11538?
CVE-2025-11538 affects Keycloak's server distribution when debug mode is enabled.
What are the implications of CVE-2025-11538?
The implications of CVE-2025-11538 include increased risk of unauthorized access and exploitation by attackers on the same network.
How can I determine if my Keycloak installation is vulnerable to CVE-2025-11538?
You can determine vulnerability to CVE-2025-11538 by checking if debug mode is enabled and if the JDWP port is bound to all interfaces.