Keycloak Management Service Debug Information Exposure Vulnerability in Arqit Symmetric Key Agreement Platform

A vulnerability exists in the Arqit Symmetric Key Agreement Platform in versions prior to 26.03, where the Keycloak management service is exposed. This exposure allows unauthorized access to sensitive debug information, including metrics and health data, through an unencrypted HTTP GET request. The Keycloak developer advises against exposing this interface externally due to the sensitive nature of the information revealed.

Impact

The vulnerability allows unauthorized access to sensitive debug information, such as metrics and health data, which could be exploited to gain insights into the application's internal workings or performance.

Remediation

Users can upgrade to Arqit Symmetric Key Agreement Platform version 26.03 or later to address this vulnerability.