Keycloak Unrestricted Access to Environment Variables Vulnerability for Admin Users

A vulnerability in Keycloak allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. This issue arises when admin users configure backchannel logout URLs or admin URLs, as they can include placeholders that the server replaces with actual values during URL processing. The vulnerability is present in Red Hat build of Keycloak 26.0.8, specifically within the Keycloak Quarkus server component.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive environment variables and system properties, potentially allowing for further attacks or information disclosure.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.0.8, which is available through the Red Hat Customer Portal. Instructions for applying the update can be found on the Customer Portal.