GHSA-8hxp-qmph-w5gq
Keycloak Potential Variable Reference in Model Storage Services
Quick fix
GHSA-8hxp-qmph-w5gq — org.keycloak:keycloak-model-storage-services: upgrade to the fixed version with the command below.
# pom.xml: bump <version>26.3.4</version> for org.keycloak:keycloak-model-storage-servicesDetails
A flaw was found in org.keycloak/keycloak-model-storage-service. The `KeycloakRealmImport` custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for org.keycloak:keycloak-model-storage-services (maven). Pin to a known-safe version or switch to an alternative.
26.3.0 Fixed in: 26.3.4 # pom.xml: bump <version>26.3.4</version> for org.keycloak:keycloak-model-storage-services References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-8hxp-qmph-w5gq [WEB]
- https://access.redhat.com/errata/RHSA-2025:15336 [WEB]
- https://access.redhat.com/errata/RHSA-2025:15337 [WEB]
- https://access.redhat.com/errata/RHSA-2025:15338 [WEB]
- https://access.redhat.com/errata/RHSA-2025:15339 [WEB]
- https://access.redhat.com/errata/RHSA-2025:16399 [WEB]
- https://access.redhat.com/errata/RHSA-2025:16400 [WEB]
- https://access.redhat.com/security/cve/CVE-2025-9162 [WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2389396 [WEB]
- https://github.com/keycloak/keycloak [PACKAGE]
- https://github.com/keycloak/keycloak/blob/26.3.3/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L36 [WEB]
- https://github.com/keycloak/keycloak/blob/75afda410495a9576e00edc3277ab42ca155f806/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L35 [WEB]