CVE-2024-5967: Keycloak: leak of configured ldap bind credentials through the keycloak admin console

Severity: low (CVSS 2.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-18 · updated 2026-06-17
Weakness: CWE-276

Description

A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.

Affected products

Red Hat build of Keycloak 22: all versions — fixed in 22-17, 22-20, 22.0.12-1
Red Hat Single Sign-On 7.6 for RHEL 7: all versions — fixed in 0:18.0.16-1.redhat_00001.1.el7sso
Red Hat Single Sign-On 7.6 for RHEL 8: all versions — fixed in 0:18.0.16-1.redhat_00001.1.el8sso
Red Hat Single Sign-On 7.6 for RHEL 9: all versions — fixed in 0:18.0.16-1.redhat_00001.1.el9sso
Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.6-52

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 22 22-17, 22-20, 22.0.12-1; Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.16-1.redhat_00001.1.el7sso; Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.16-1.redhat_00001.1.el8sso; Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.16-1.redhat_00001.1.el9sso; Red Hat RHEL-8 based Middleware Containers 7.6-52. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-5967 or the next vulnerability affects your stack