Description
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Keycloak | keycloak | < 26.4.4 | 26.4.4 |
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.4 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-dist | < 26.4.4 | 26.4.4 | GHSA-j4vq-q93m-4683 |
Advisories 1
- WID-SEC-2025-2606 Keycloak: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 26, 2026
References
- RHSA-2025:21370 vendor-advisory
- RHSA-2025:21371 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-11538 vdb-entry
- RHBZ#2402622 issue-tracking
- https://github.com/keycloak/keycloak/commit/9e98f2bf961f68853cea6fbec58b512ed8be7ca9
- https://github.com/keycloak/keycloak/pull/43574