CVE-2025-10043

keycloak: Incomplete fix of CVE-2024-10492

View on CVE.org
Published Sep 5, 2025 CVSS 3.1 · 2.7 Low EPSS n/a KEV · Not listed
Description
Considered by the maintainers a bug scenario experienced rather than a vulnerability.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-27027 A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The previous fix for CVE-2024-10492 did not account for the Windows file separator (\). As a result, a high-privilege administrator could probe for the existence of files outside the expected realm context through crafted vault secret lookups. This is a platform-specific variant/incomplete fix of CVE-2024-10492.
History
Type Values Removed Values Added
Title Keycloak: incomplete fix of cve-2024-10492 keycloak: Incomplete fix of CVE-2024-10492
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The previous fix for CVE-2024-10492 did not account for the Windows file separator (\). As a result, a high-privilege administrator could probe for the existence of files outside the expected realm context through crafted vault secret lookups. This is a platform-specific variant/incomplete fix of CVE-2024-10492. Considered by the maintainers a bug scenario experienced rather than a vulnerability.
CPEs cpe:/a:redhat:build_keycloak:26.2::el9
Vendors & Products Redhat
Redhat build Keycloak
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.2::el9
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A path traversal validation flaw exists in Keycloak’s vault key handling on Windows. The previous fix for CVE-2024-10492 did not account for the Windows file separator (\). As a result, a high-privilege administrator could probe for the existence of files outside the expected realm context through crafted vault secret lookups. This is a platform-specific variant/incomplete fix of CVE-2024-10492.
Title Keycloak: incomplete fix of cve-2024-10492
First Time appeared Redhat
Redhat build Keycloak
Weaknesses CWE-73
CPEs cpe:/a:redhat:build_keycloak:
Vendors & Products Redhat
Redhat build Keycloak
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}
Earlier changes (3)

Subscriptions

No data.

Weaknesses

Sources

Status
REJECTED
Assigner
redhat
Published
Updated
Oct 9, 2025, 1:45 AM
Reserved
Sep 5, 2025, 6:12 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Sep 5, 2025, 8:15 PM
Modified
Oct 9, 2025, 2:15 AM

View source JSON

Severity
Low
Public date
Sep 5, 2025, 12:00 AM

View source Bugzilla JSON

No data.