GHSA-8hxp-qmph-w5gq
Keycloak Potential Variable Reference in Model Storage Services
Quick fix
GHSA-8hxp-qmph-w5gq — org.keycloak:keycloak-model-storage-services: upgrade to the fixed version with the command below.
# pom.xml: bump <version>26.3.4</version> for org.keycloak:keycloak-model-storage-servicesDetails
A flaw was found in org.keycloak/keycloak-model-storage-service. The `KeycloakRealmImport` custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for org.keycloak:keycloak-model-storage-services (maven). Pin to a known-safe version or switch to an alternative.
26.3.0Fixed in: 26.3.4# pom.xml: bump <version>26.3.4</version> for org.keycloak:keycloak-model-storage-servicesReferences
- https://github.com/keycloak/keycloak/security/advisories/GHSA-8hxp-qmph-w5gq[WEB]
- https://access.redhat.com/errata/RHSA-2025:15336[WEB]
- https://access.redhat.com/errata/RHSA-2025:15337[WEB]
- https://access.redhat.com/errata/RHSA-2025:15338[WEB]
- https://access.redhat.com/errata/RHSA-2025:15339[WEB]
- https://access.redhat.com/errata/RHSA-2025:16399[WEB]
- https://access.redhat.com/errata/RHSA-2025:16400[WEB]
- https://access.redhat.com/security/cve/CVE-2025-9162[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2389396[WEB]
- https://github.com/keycloak/keycloak[PACKAGE]
- https://github.com/keycloak/keycloak/blob/26.3.3/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L36[WEB]
- https://github.com/keycloak/keycloak/blob/75afda410495a9576e00edc3277ab42ca155f806/model/storage-services/src/main/java/org/keycloak/exportimport/AbstractFileBasedImportProvider.java#L35[WEB]