CVE-2025-9162 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
Attackers can inject malicious content via crafted realm documents during import, potentially leading to code execution or privilege escalation in Keycloak.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9162?
CVE-2025-9162 is a medium-severity code injection vulnerability in Red Hat build of Keycloak 26.0, published on 21 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.
Weakness: CWE-526
Which versions are affected by CVE-2025-9162?
4 open source packages ship an affected version, including org.keycloak:keycloak-model-storage-services.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-model-storage-services Maven | All versions | None |
org.keycloak:keycloak-model-storage-services Maven | All versions | None |
org.keycloak:keycloak-model-storage-services Maven | From 26.3.0 | 26.3.4 |
org.keycloak:keycloak-model-storage-services Maven | From 26.3.0 | 26.3.4 |
How do I fix CVE-2025-9162?
Upgrade org.keycloak:keycloak-model-storage-services to 26.3.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-9162 being exploited?
There is no known exploitation of CVE-2025-9162 in the wild and no public exploit code.
Sources
Also known as ECHO-a489-ffe0-f1d7, GHSA-8hxp-qmph-w5gq, MINI-46x7-6pmq-6xr7.