https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T20:53:17.538777+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-11736 CVE-2024-11736 — Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables 2026-10-07T20:53:17.564030+00:00

Affected: keycloak, Red Hat build of Keycloak 26.0, Red Hat RHBK 26.0.8, Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.