CVE-2025-9162: Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
Other sources
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
— GitHub
There is a potential security issue with the KeycloakRealmImport custom resource. Placeholders within the realm document, which may reference environment variables, will be replaced as part of the import process. That provides a way to inject into the realm sensitive environment variables, such as the database password. See https://github.com/keycloak/keycloak/blob/75afda410495a9576e00edc3277ab42ca155f806/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L35
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9162?
CVE-2025-9162 is classified as a medium severity vulnerability due to the potential for injection attacks.
How do I fix CVE-2025-9162?
To fix CVE-2025-9162, update your Keycloak installation to the latest version that addresses this vulnerability.
What versions of the keycloak-model-storage-service are affected by CVE-2025-9162?
CVE-2025-9162 affects all versions of keycloak-model-storage-service that allow realm document placeholders to be substituted.
What type of vulnerability is CVE-2025-9162?
CVE-2025-9162 is a code injection vulnerability that can lead to unauthorized command execution when improperly handled.
Where can I find more information about CVE-2025-9162?
More information about CVE-2025-9162 can be found in the official CVE database or security advisories related to Keycloak.