CVE-2024-10973

5.7 mediumEPSS 0.3%

Medium (5.7). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in org.keycloak:keycloak-quarkus-server 26.0.6.

A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

Severity

CVSS 3.1

5.7 medium

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-319
Published: 2024-12-17
Modified: 2026-08-08
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-g6qq-c9f9-2772	Maven	org.keycloak:keycloak-quarkus-server	>=25.0.0 <26.0.6	26.0.6

References

https://access.redhat.com/security/cve/CVE-2024-10973
https://bugzilla.redhat.com/show_bug.cgi?id=2324361

Check your stack JSON