{"id":"CVE-2025-48374","aliases":["EUVD-2025-16350","GHSA-c37v-3c8w-crq8","GO-2025-3705","openSUSE-SU-2025:15179-1"],"status":"published","title":"zot logs secrets","description":"zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00181,"percentile":0.07702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2025-05-22T20:33:39Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Go","package":"zotregistry.dev/zot","fixed_in":["1.4.4-0.20250522160828-8a99a3ed231f"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"zotregistry.dev/zot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-0.20250522160828-8a99a3ed231f"}]}]},{"source":"osv","ecosystem":"Go","package":"zotregistry.dev/zot","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.4-0.20250522160828-8a99a3ed231f"}]}]},{"source":"osv","ecosystem":"Go","package":"zotregistry.dev/zot","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.4-0.20250522160828-8a99a3ed231f"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250527T204717-1.1"}]}],"bundled":4}],"products":[{"vendor":"project-zot","product":"zot"}],"references":[{"url":"https://github.com/project-zot/zot/security/advisories/GHSA-c37v-3c8w-crq8","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48374","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3705","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c37v-3c8w-crq8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48374.json","tags":["advisory"]},{"url":"https://github.com/project-zot/zot","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NUT27N46T3RCYUKKZDD2PQ3C7X7OURLR/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48374","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-48374","title":"zot logs secrets","description":"zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.","status":"published","published":"2025-05-22T20:43:13.708Z","modified":"2025-05-23T14:33:24.239Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-16350","description":"zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.","status":"published","published":"2025-05-22T20:43:13Z","modified":"2025-05-23T14:33:24Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T20:32:39.383071Z"}],"ghsa":[{"id":"GHSA-c37v-3c8w-crq8","title":"zot logs secrets","description":"### Summary\nWhen using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup.\n\n### Details\nContainer Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest\nHere is an example how the configuration can look which causes the above stated problem:\n\n`    http:\n      address: \"0.0.0.0\"\n      port: 5000\n      externalUrl: \"https://zot.example.com\"\n      auth: {\n        failDelay: 1,\n        openid: {\n          providers: {\n            oidc: {\n              name: \"Keycloak\",\n              clientid: \"zot-client-id\",\n              clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l,\n              keypath: \"\",\n              issuer: \"https://keycloak.example.com/realms/example\",\n              scopes: [\"openid\"]\n            }\n          }\n        }\n      }\n`\n\n### PoC\nSet up a blank new zot k8s deployment with the code snippet above.\n\n### Impact\nexposure of secrets, on configuring a oidc provider","status":"published","published":"2025-05-22T20:33:39Z","modified":"2025-05-28T19:47:48Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"nvd":[{"id":"CVE-2025-48374","description":"zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.","status":"published","published":"2025-05-22T21:15:37.96Z","modified":"2026-06-17T09:29:34.13Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:11:09.562272Z"}],"osv":[{"id":"CVE-2025-48374","title":"zot logs secrets","description":"zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.","status":"published","published":"2025-05-22T20:43:13.708Z","modified":"2026-10-28T02:31:00.488129235Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-c37v-3c8w-crq8","title":"zot logs secrets","description":"### Summary\nWhen using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup.\n\n### Details\nContainer Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest\nHere is an example how the configuration can look which causes the above stated problem:\n\n`    http:\n      address: \"0.0.0.0\"\n      port: 5000\n      externalUrl: \"https://zot.example.com\"\n      auth: {\n        failDelay: 1,\n        openid: {\n          providers: {\n            oidc: {\n              name: \"Keycloak\",\n              clientid: \"zot-client-id\",\n              clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l,\n              keypath: \"\",\n              issuer: \"https://keycloak.example.com/realms/example\",\n              scopes: [\"openid\"]\n            }\n          }\n        }\n      }\n`\n\n### PoC\nSet up a blank new zot k8s deployment with the code snippet above.\n\n### Impact\nexposure of secrets, on configuring a oidc provider","status":"published","published":"2025-05-22T20:33:39Z","modified":"2025-05-28T19:47:48Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"GO-2025-3705","title":"zot logs secrets in zotregistry.dev/zot","description":"zot logs secrets in zotregistry.dev/zot","status":"published","published":"2025-05-27T20:47:04Z","modified":"2026-03-03T04:56:37.403922Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15179-1","title":"govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250527T204717-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-30T00:00:00Z","modified":"2026-03-23T04:53:27.331108Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}