CVE-2024-10973

Keycloak: cli option for encrypted jgroups ignored

5.7 MediumFix available

A vulnerability was found in Keycloak. The environment option KC_CACHE_EMBEDDED_MTLS_ENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.27%Up 0.2 points since Dec 18, 2024

What each source reports

CVE List Score used 5.7

Keycloak: cli option for encrypted jgroups ignored

Record: CVE-2024-10973
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

EUVDEUVD-2025-0239 5.7

Record: EUVD-2025-0239
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g6qq-c9f9-2772 5.7

Keycloak on Quarkus CLI option for encrypted JGroups ignored

The env option KC_CACHE_EMBEDDED_MTLS_ENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644.

Record: GHSA-g6qq-c9f9-2772
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

NVD 5.7

Record: CVE-2024-10973
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

OSV 5.7

Keycloak: cli option for encrypted jgroups ignored

Record: CVE-2024-10973
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

OSVGHSA-g6qq-c9f9-2772 5.7

Keycloak on Quarkus CLI option for encrypted JGroups ignored

Record: GHSA-g6qq-c9f9-2772
CVSS 3.1: 5.7 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.keycloak:keycloak-quarkus-server` Maven	25.0.0 up to 26.0.6	26.0.6
`org.keycloak:keycloak-quarkus-server` Maven	25.0.0 up to 26.0.6, plus listed versions 25.0.125.0.225.0.325.0.425.0.5 Show 6 moreShow less 25.0.626.0.026.0.126.0.226.0.426.0.5	26.0.6

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10973 is a medium vulnerability (CVSS 5.7) in Red Hat Build Of Keycloak, published December 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in org.keycloak:keycloak-quarkus-server 26.0.6.

References

Show 9 moreShow less