Medium severity4.9GHSA Advisory· Published Jan 14, 2025· Updated Apr 15, 2026
CVE-2024-11736
CVE-2024-11736
Description
A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-quarkus-serverMaven | < 26.0.8 | 26.0.8 |
Affected products
10- osv-coords9 versionspkg:apk/chainguard/keycloakpkg:apk/chainguard/keycloak-bitnami-compatpkg:apk/chainguard/keycloak-compatpkg:apk/chainguard/keycloak-iamguarded-compatpkg:apk/wolfi/keycloakpkg:apk/wolfi/keycloak-bitnami-compatpkg:apk/wolfi/keycloak-compatpkg:apk/wolfi/keycloak-iamguarded-compatpkg:maven/org.keycloak/keycloak-quarkus-server
< 26.0.8-r0+ 8 more
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8-r0
- (no CPE)range: < 26.0.8
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-f4v7-3mww-9gc2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-11736ghsaADVISORY
- access.redhat.com/errata/RHSA-2025:0299nvdWEB
- access.redhat.com/errata/RHSA-2025:0300nvdWEB
- access.redhat.com/security/cve/CVE-2024-11736nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/keycloak/keycloak/commit/7a76858fe4aa39a39fb6b86dd3d2c113d9c59854ghsaWEB
- github.com/keycloak/keycloak/security/advisories/GHSA-f4v7-3mww-9gc2ghsaWEB
News mentions
0No linked articles in our index yet.