REDHAT-BUG-2501730: Medium severity Keycloak Keycloak vulnerability
A denial of service vulnerability was discovered in Keycloak metrics implementation. When user-event metrics are enabled, the EventMetricsProvider records the verbatim error message from failed account operations as a Prometheus metric label. The account consent endpoint specifically embeds caller-supplied input, such as nonexistent client IDs or invalid scope names, directly into these error messages. An authenticated attacker with manage-account or manage-consent permissions can exploit this by repeatedly calling the account consent delete endpoint with unique, randomized client ID values. Each request results in a distinct error message and a corresponding new Prometheus metric time series. This leads to unbounded metric cardinality, which can exhaust the memory of both the Keycloak instance and the connected monitoring system, resulting in a denial of service and degradation of metrics availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If user-event metrics are enabled, disable EventMetricsProvider recording so that verbatim error messages from failed account operations are not used as Prometheus metric label values (prevents unbounded metric cardinality).
Keycloak (account consent delete endpoint) EventMetricsProvider (user-event metrics) = disable when not required - Compensating control
Use an external control (e.g., network/WAF/ACL) to restrict access to the account consent delete endpoint so authenticated attackers with manage-account/manage-consent permissions cannot repeatedly call it with randomized client IDs.
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker must be authenticated and have manage-account or manage-consent permissions. Exploitation relies on repeatedly sending account consent deletion requests with unique randomized client ID values.
What configuration makes this vulnerability reachable?
The issue is exposed when user-event metrics are enabled. In that configuration, failed account operations can create distinct Prometheus metric labels from verbatim error messages.
How can I identify active exploitation or impact?
You may be under attack if Prometheus time-series cardinality grows continuously alongside repeated failed account consent deletion requests, particularly requests using many unique nonexistent client IDs or invalid scope values. The resulting memory pressure can affect both Keycloak and the connected monitoring system.