CVE-2025-9162

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2025
Source publication: Aug 21, 2025
Source updated: Dec 19, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

keycloak

Vendor: Keycloak
Product: keycloak
Platforms: Unknown
Default status: unaffected
Package: keycloak
Package collection: https://github.com/keycloak/keycloak

keycloak · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	semver	26.3.4	Unavailable	None listed

Red Hat build of Keycloak 26.0

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.0
Platforms: Unknown
Default status: unaffected
Package: org.keycloak/keycloak-model-storage-service
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.0

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.0
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.0 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.0.15-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.0

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.0
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.0 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.0-18	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.0

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.0
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.0 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.0-19	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: unaffected
Package: org.keycloak/keycloak-model-storage-service
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2.8-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2-8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2-8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2.9-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2-9	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.2-9	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.2.9

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.2.9
Platforms: Unknown
Default status: unaffected
Package: org.keycloak/keycloak-model-storage-service
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.