CVE-2024-10492
Keycloak-quarkus-server: keycloak path trasversal
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Keycloak-quarkus-server: keycloak path trasversal
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
- Record
CVE-2024-10492- CVSS 3.0
- 2.7 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
EUVDEUVD-2024-3342
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
- Record
EUVD-2024-3342- CVSS 3.0
- 2.7 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5545-r4hg-rj4m
Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
- Record
GHSA-5545-r4hg-rj4m- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 2.7 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
NVD
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
- Record
CVE-2024-10492- CVSS 3.0
- 2.7 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSV
Keycloak-quarkus-server: keycloak path trasversal
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
- Record
CVE-2024-10492- CVSS 3.0
- 2.7 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSVGHSA-5545-r4hg-rj4m
Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
- Record
GHSA-5545-r4hg-rj4m- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 2.7 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-quarkus-serverMaven |
before 24.0.9 | 24.0.9 |
org.keycloak:keycloak-quarkus-serverMaven |
25.0.0 up to 26.0.6 | 26.0.6 |
org.keycloak:keycloak-quarkus-serverMaven |
before 26.0.6, plus listed versions 12.0.012.0.112.0.212.0.312.0.4 Show 45 moreShow less13.0.013.0.114.0.015.0.015.0.115.0.215.1.015.1.116.0.016.1.016.1.117.0.017.0.118.0.018.0.118.0.219.0.019.0.119.0.219.0.320.0.020.0.120.0.220.0.320.0.420.0.521.0.021.0.121.0.221.1.021.1.121.1.222.0.022.0.122.0.222.0.322.0.422.0.523.0.023.0.123.0.223.0.323.0.423.0.523.0.6 |
26.0.6 |
org.keycloak:keycloak-quarkus-serverMaven |
25.0.0 up to 26.0.6, plus listed versions 25.0.125.0.225.0.325.0.425.0.5 Show 6 moreShow less25.0.626.0.026.0.126.0.226.0.426.0.5 |
26.0.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-10492 is a low vulnerability (CVSS 2.7) in Red Hat Build Of Keycloak 24, published November 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in org.keycloak:keycloak-quarkus-server 24.0.9.
References
access.redhat.com/errata/RHSA-2024:10175
bugzilla.redhat.com/show_bug.cgi?id=2322447
Show 11 moreShow less
github.com/keycloak/keycloak/issues/35215
nvd.nist.gov/vuln/detail/CVE-2024-10492
catalog.redhat.com/software/containers
Left out here: 19 versions. The JSON record has them.