CVE-2025-11538: keycloak Binding to an Unrestricted IP Address
Vulnerability summary
CVE-2025-11538 is a medium (CVSS 6.8) Binding to an Unrestricted IP Address vulnerability in keycloak. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.3% of scored vulnerabilities.
Advisory lineage
Upstream 1 · Downstream 0 · Related 1Timeline
- 13-11-2025PublishedVulnerability first disclosed.
- 19-12-2025Last modifiedVulnerability information updated.
Description
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.03 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard5 products
- keycloak-26.2< 26.2.5-r7
- keycloak-26.2-iamguarded-compat< 26.2.5-r7
- keycloak-26.3-iamguarded-compat< 26.3.5-r4
- keycloak-fips-26.2-iamguarded-fips< 26.2.5-r9
- keycloak-fips-26.3-iamguarded-fips< 26.3.5-r5
Keycloak1 product
- keycloak< 26.4.4
Org.keycloak1 product
- keycloak-quarkus-dist< 26.4.4
3 vendors · 7 products
References
12 links
Show all 12 references
- github.com/keycloak/keycloakPACKAGE