CVE-2024-10451— Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process
Quick assessment
Affected
Red Hat Red Hat build of Keycloak 24
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat Keycloak是美国红帽（Red Hat）公司的一套为现代应用和服务提供身份验证和管理功能的软件。 Red Hat Keycloak存在安全漏洞，该漏洞源于敏感数据在构建过程中被嵌入字节码或环境变量中作为默认值，导致信息泄露。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 24 | 24.0.9-1< * |
unaffected |
24-18< * |
unaffected | ||
24-18< * |
unaffected | ||
| Red Hat | Red Hat build of Keycloak 24.0.9 | any |
unaffected |
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0.6-2< * |
unaffected |
26.0-5< * |
unaffected | ||
26.0-6< * |
unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.0.6 | any |
unaffected |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | any |
unaffected |
| Red Hat | Red Hat Single Sign-On 7 | any |
unknown |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-10451
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Keycloak 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Keycloak是美国红帽（Red Hat）公司的一套为现代应用和服务提供身份验证和管理功能的软件。 Red Hat Keycloak存在安全漏洞，该漏洞源于敏感数据在构建过程中被嵌入字节码或环境变量中作为默认值，导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 24 | 24.0.9-1 ~ * |
cpe:/a:redhat:build_keycloak:24::el9
|
|
| Red Hat | Red Hat build of Keycloak 24 | 24-18 ~ * |
cpe:/a:redhat:build_keycloak:24::el9
|
|
| Red Hat | Red Hat build of Keycloak 24 | 24-18 ~ * |
cpe:/a:redhat:build_keycloak:24::el9
|
|
| Red Hat | Red Hat build of Keycloak 24.0.9 | - |
cpe:/a:redhat:build_keycloak:24
|
|
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0.6-2 ~ * |
cpe:/a:redhat:build_keycloak:26.0::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0-5 ~ * |
cpe:/a:redhat:build_keycloak:26.0::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.0 | 26.0-6 ~ * |
cpe:/a:redhat:build_keycloak:26.0::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.0.6 | - |
cpe:/a:redhat:build_keycloak:26.0
|
|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | - |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
|
| Red Hat | Red Hat Single Sign-On 7 | - |
cpe:/a:redhat:red_hat_single_sign_on:7
|
|
II. Public POCs for CVE-2024-10451
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-10451
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-10451 (3)
-
-
🔗 RHSA-2024:10177 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2024:10175 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50
Same weakness: CWE-798
-
CVE-2026-105147
SciPhi-AI R2R JWT Secret hard-coded credentials -
CVE-2026-105141
topoteretes cognee JWT Signing Key get_api_auth_backend.py g -
CVE-2026-94592
Armatura LLC Armatura One Use of Hard-coded Credentials -
CVE-2026-103097
GV-Eye Relay Payment API Key Vulnerability -
CVE-2026-103096
GV-Eye Hardcoded API Key Vulnerability
V. Comments for CVE-2024-10451
No comments yet