CVE-2024-10973: Keycloak: cli option for encrypted jgroups ignored

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-17 · updated 2026-08-08
Weakness: CWE-319

Description

A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

References

https://access.redhat.com/security/cve/CVE-2024-10973
https://bugzilla.redhat.com/show_bug.cgi?id=2324361

Get alerted when CVE-2024-10973 or the next vulnerability affects your stack