CVE-2025-48374: zot logs secrets
Summary When using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup.
Details Container Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest Here is an example how the configuration can look which causes the above stated problem:
http: address: "0.0.0.0" port: 5000 externalUrl: "https://zot.example.com" auth: { failDelay: 1, openid: { providers: { oidc: { name: "Keycloak", clientid: "zot-client-id", clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l, keypath: "", issuer: "https://keycloak.example.com/realms/example", scopes: ["openid"] } } } }
PoC Set up a blank new zot k8s deployment with the code snippet above.
Impact exposure of secrets, on configuring a oidc provider
Other sources
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48374?
CVE-2025-48374 has a moderate severity rating due to the exposure of client secrets in container logs.
How do I fix CVE-2025-48374?
To mitigate CVE-2025-48374, upgrade to Zot version 2.1.3 or later, or the specified patch version 1.4.4-0.20250522160828-8a99a3ed231f.
Which versions are affected by CVE-2025-48374?
CVEs 2.1.3 and earlier versions of Zot are affected by CVE-2025-48374.
What kind of data is exposed in the logs due to CVE-2025-48374?
CVE-2025-48374 exposes sensitive client secrets in the stdout logs when the container starts.
Is there a specific configuration that triggers CVE-2025-48374?
CVE-2025-48374 is triggered when Keycloak is used as an OIDC provider without logging configurations that secure sensitive data.