CVE-2024-10451: Use of Hard-coded Credentials in Red Hat Red Hat build of Keycloak 24
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.
AI Analysis
Technical Summary
This vulnerability arises from the Keycloak build process embedding sensitive runtime values, including passwords, as default values in bytecode. In Keycloak 26 and earlier versions (up to 26.0.2), environment variables containing sensitive data specified during the build are captured unconditionally by the PropertyMapper logic, leading to unintended exposure of sensitive information at runtime. The flaw affects all Keycloak versions up to 26.0.2. Red Hat has issued security advisories and released updated Keycloak 24.0.9 images for OpenShift Container Platform that include fixes for this issue.
Potential Impact
The vulnerability allows unintended disclosure of sensitive data such as passwords embedded in the Keycloak build artifacts. This exposure could lead to compromise of sensitive credentials if an attacker gains access to the affected Keycloak runtime environment or artifacts. The CVSS score of 5.9 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated Keycloak 24.0.9 images that address this vulnerability. Users should apply these updates as provided in the Red Hat advisories (RHSA-2024:10175 and RHSA-2024:10176). Before updating, it is recommended to back up existing installations, including configurations and databases. Applying the official Red Hat patches is the primary remediation. Patch status is confirmed by Red Hat advisories. No alternative mitigations or workarounds are specified.
CVE-2024-10451: Use of Hard-coded Credentials in Red Hat Red Hat build of Keycloak 24
Description
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from the Keycloak build process embedding sensitive runtime values, including passwords, as default values in bytecode. In Keycloak 26 and earlier versions (up to 26.0.2), environment variables containing sensitive data specified during the build are captured unconditionally by the PropertyMapper logic, leading to unintended exposure of sensitive information at runtime. The flaw affects all Keycloak versions up to 26.0.2. Red Hat has issued security advisories and released updated Keycloak 24.0.9 images for OpenShift Container Platform that include fixes for this issue.
Potential Impact
The vulnerability allows unintended disclosure of sensitive data such as passwords embedded in the Keycloak build artifacts. This exposure could lead to compromise of sensitive credentials if an attacker gains access to the affected Keycloak runtime environment or artifacts. The CVSS score of 5.9 reflects a medium severity impact with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated Keycloak 24.0.9 images that address this vulnerability. Users should apply these updates as provided in the Red Hat advisories (RHSA-2024:10175 and RHSA-2024:10176). Before updating, it is recommended to back up existing installations, including configurations and databases. Applying the official Red Hat patches is the primary remediation. Patch status is confirmed by Red Hat advisories. No alternative mitigations or workarounds are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2024-10-28T07:34:31.748Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2024:10175","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:10176","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:10177","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2024:10178","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2024-10451","vendor":"Red Hat"}]
Threat ID: 691362a4f922b639ab5baf85
Added to database: 11/11/2025, 16:21:56 UTC
Last enriched: 08/11/2026, 18:07:57 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 263
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.