CVE-2025-11538

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2025:21370
https://access.redhat.com/errata/RHSA-2025:21371
https://access.redhat.com/security/cve/CVE-2025-11538
https://bugzilla.redhat.com/show_bug.cgi?id=2402622
https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9
https://github.com/keycloak/keycloak/pull/43574

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad existe en la distribución del servidor de Keycloak donde la activación del modo de depuración (--debug <port>) por defecto enlaza de forma insegura el puerto del Java Debug Wire Protocol (JDWP) a todas las interfaces de red (0.0.0.0). Esto expone el puerto de depuración a la red local, permitiendo que un atacante en el mismo segmento de red adjunte un depurador remoto y logre la ejecución remota de código dentro de la máquina virtual Java de Keycloak.

Information

Published : 2025-11-13 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-11538

Mitre link : CVE-2025-11538

CVE.ORG link : CVE-2025-11538

JSON object : View

Products Affected

No product.

CWE

CWE-1327

Binding to an Unrestricted IP Address

{"id": "CVE-2025-11538", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11538", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T18:01:03.893934Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "Keycloak", "product": "keycloak", "versions": [{"status": "affected", "version": "0", "lessThan": "26.4.4", "versionType": "semver"}], "packageName": "keycloak", "collectionURL": "https://github.com/keycloak/keycloak", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4.4-1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-3", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-3", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.4", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2025-11-13T17:15:44.820", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:21370", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:21371", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-11538", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402622", "source": "secalert@redhat.com"}, {"url": "https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9", "source": "secalert@redhat.com"}, {"url": "https://github.com/keycloak/keycloak/pull/43574", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-1327"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine."}, {"lang": "es", "value": "Una vulnerabilidad existe en la distribuci\u00f3n del servidor de Keycloak donde la activaci\u00f3n del modo de depuraci\u00f3n (--debug <port>) por defecto enlaza de forma insegura el puerto del Java Debug Wire Protocol (JDWP) a todas las interfaces de red (0.0.0.0). Esto expone el puerto de depuraci\u00f3n a la red local, permitiendo que un atacante en el mismo segmento de red adjunte un depurador remoto y logre la ejecuci\u00f3n remota de c\u00f3digo dentro de la m\u00e1quina virtual Java de Keycloak."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "secalert@redhat.com"}