This vulnerability in Keycloak involves external control of file name or path, enabling a privileged user to read sensitive Vault files not intended to be accessible. The attacker must already have high privileges on the Keycloak server to perform resource creation that triggers the vulnerability, such as configuring an LDAP provider and setting up a Vault read file. The vulnerability is classified as a path traversal issue and has a CVSS 3.0 base score of 2.7 (low severity). Red Hat advisories confirm that fixed packages for Red Hat build of Keycloak 24.0.9 are available, addressing this vulnerability along with other security issues.

The impact is limited to information disclosure of Vault files outside the expected context, requiring prior high privileges on the Keycloak server. There is no indication of integrity or availability impact. The vulnerability allows an attacker to determine the existence of files but does not provide broader access or control. Given the prerequisite of high privileges, the risk is reduced to scenarios where an attacker has already compromised administrative access.

Red Hat has released updated packages for Red Hat build of Keycloak 24.0.9 that fix this vulnerability. Users should apply these official security updates as provided in Red Hat advisories RHSA-2024:10175 and RHSA-2024:10176. Before updating, back up existing installations including configurations and databases. No additional mitigation is required beyond applying the vendor-provided patches.