{"id":"CVE-2024-10492","revision":"6e7bba5a35514d0d9751a98ff3cbef61","records":[{"revision":"6e7bba5a35514d0d9751a98ff3cbef61","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-10492","aliases":[],"title":"Keycloak-quarkus-server: keycloak path trasversal","description":"A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.","state":0,"publishedAt":"2024-11-25T07:37:30.572+00:00","modifiedAt":"2026-10-13T21:01:54.109+00:00","affected":[{"ecosystem":"https://github.com/keycloak/keycloak","name":"keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"26.0.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"keycloak\",\n                    \"collectionURL\": \"https://github.com/keycloak/keycloak\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24.0.9-1\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24-18\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24-18\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"keycloak-quarkus-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24.0.9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"keycloak-quarkus-server\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"26.0.6-2\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"26.0-5\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"26.0-6\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"keycloak-quarkus-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0.6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"keycloak-quarkus-server\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"keycloak-quarkus-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 8\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"keycloak-quarkus-server\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"keycloak-quarkus-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"keycloak-quarkus-server\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jbosseapxp\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"keycloak-quarkus-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"keycloak-quarkus-server\",\n                    \"defaultStatus\": \"unknown\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","score":2.7,"severity":"LOW"}],"references":["https://access.redhat.com/errata/RHSA-2024:10175","https://access.redhat.com/errata/RHSA-2024:10176","https://access.redhat.com/errata/RHSA-2024:10177","https://access.redhat.com/errata/RHSA-2024:10178","https://access.redhat.com/security/cve/CVE-2024-10492","https://bugzilla.redhat.com/show_bug.cgi?id=2322447","https://github.com/keycloak/keycloak/issues/35215","https://github.com/keycloak/keycloak/pull/35223"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-10492","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-10492","identifiers":["CVE-2024-10492"]},"retained":false,"historicalAffected":[]}],"coverage":[]}