4.9

CVE-2025-9162: keycloak

CVSS: 4.9v3.1MediumDeferred
AliasesCGA-55r7-34h8-3fp3CGA-7fqc-qgwm-8mhjCGA-f256-49qc-h6gr
Published 21-08-2025Last modified 19-12-2025
Open JSON

Vulnerability summary

CVE-2025-9162 is a medium (CVSS 4.9) vulnerability in keycloak. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.

Overall risk
20/100
0100
Low · default modelHow is this calculated?
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.50%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-7CX2-MGMP-6GFG

Timeline

  1. 21-08-2025
    PublishedVulnerability first disclosed.
  2. 19-12-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

0.00 pp

From 0.50% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • keycloak-26.2All versions (No fix recorded) | < 26.2.5-r6
  • keycloak-26.2-iamguarded-compatAll versions (No fix recorded)
  • keycloak-fips-26.2-iamguarded-fipsAll versions (No fix recorded)
Keycloak1 product
Org.keycloak1 product
  • keycloak-model-storage-servicesAll versions (No fix recorded) | ≥ 26.3.0, < 26.3.4

3 vendors · 5 products

References

16 links
Show all 16 references