What’s Vulnerable › Vulnerabilities

CVE-2025-11538: Keycloak-server: debug default bind address

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-13 · updated 2026-10-18
• Weakness: CWE-1327

Description

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Affected products

• Red Hat build of Keycloak 26.4: all versions — fixed in 26.4-3, 26.4.4-1
• Keycloak: before 26.4.4 — fixed in 26.4.4

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.4-3, 26.4.4-1; Keycloak 26.4.4. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2025:21370
• https://access.redhat.com/errata/RHSA-2025:21371
• https://access.redhat.com/security/cve/CVE-2025-11538
• https://bugzilla.redhat.com/show_bug.cgi?id=2402622
• https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9
• https://github.com/keycloak/keycloak/pull/43574

Get alerted when CVE-2025-11538 or the next vulnerability affects your stack