CVE-2025-9162 - CVE House
Back to Database
Status published Medium CVE-2025-9162

Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

Vulnerability Description

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9162

Credits & Attribution

No credits recorded in the NVD database.

References

More from Keycloak

View All →
CVE-2025-8419
Org.keycloak/keycloak-services: keycloak smtp inject vulnerability
Medium 5.3
CVE-2025-13467
Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation
Medium 5.5
CVE-2025-12390
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
Medium 6
CVE-2025-12150
Org.keycloak/keycloak-services: webauthn attestation statement verification bypass
Low 3.1
CVE-2025-12110
Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed
Medium 5.4

Affected Vendor

Affected Software

keycloak, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.9
Vulnerable Versions:
0, 26.0.15-1, 26.0-18, 26.0-19, 26.2.8-1, 26.2-8, 26.2.9-1, 26.2-9

Timeline

Official Publish: August 21st, 2025
Last Modified: December 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-526

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.