4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-9162

CVE-2025-9162: Keycloak Potential Variable Reference in Model Storage Services

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker can leverage this to inject malicious content during the realm import procedure. This can lead to unintended consequences within the Keycloak environment.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-9162

CVE-2025-9162:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-model-storage-services	maven	<= 26.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

This vulnerability analysis is based on a flaw in Keycloak's realm import functionality, where placeholder substitution can be exploited to inject sensitive information from environment variables. The issue lies within the AbstractFileBasedImportProvider class, which is responsible for processing imported realm documents.

The root cause of the vulnerability is the use of StringSubstitutor to replace placeholders in the realm data. By default, StringSubstitutor can resolve environment variables, allowing an attacker with permissions to import a realm to craft a malicious realm document. This document can contain placeholders that reference environment variables on the Keycloak server, such as database credentials or other secrets. When the realm is imported, these placeholders are replaced with the actual values of the environment variables, which are then stored in the Keycloak configuration.

The patch for this vulnerability introduces a change that disables the environment variable substitution feature of StringSubstitutor by calling setEnableSubstitutionInVariables(false). This ensures that only explicitly provided values can be used for substitution, preventing the injection of sensitive data from the environment.

The vulnerable function is createProvider, which is responsible for creating the import provider and performing the placeholder substitution. During an exploit, this function would be called, and its name would appear in a runtime profile or stack trace.

For a security engineer, it is crucial to understand that any user with realm import permissions could potentially exploit this vulnerability to gain access to sensitive information stored in the environment variables of the Keycloak server. Upgrading to a patched version of Keycloak is the recommended mitigation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.