Keycloak Vulnerability Affects Sensitive Data

CVE-2024-10451

What is CVE-2024-10451?

A vulnerability was identified in Keycloak that permits the exposure of sensitive runtime values, including passwords. This flaw arises during the Keycloak build process, where sensitive information specified in environment variables can be inadvertently captured as default values within the bytecode. As a result, this information may be accessible at runtime. The issue affects Keycloak versions up to 26.0.2, where environment-variable configurations for SPI options and Quarkus properties are also susceptible to unintentional data exposure, due to unconditional value expansion mechanisms within PropertyMapper logic.

References