Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-10939

Fixed in a distro release EPSS <1%CVSS 3.7

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.

Published 2025-10-28 · CVE record · OSV

Products: keycloak, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.4

Fixed upstream

EcosystemPackageFixed in
Mavenorg.keycloak:keycloak-quarkus-server26.4.4

Distro releases

ReleasePackageFixed in
Chainguardkeycloak-26.2no fix
Chainguardkeycloak-26.226.2.5-r6
Chainguardkeycloak-26.2-compat26.2.5-r6
Chainguardkeycloak-26.2-iamguarded-compatno fix
Chainguardkeycloak-26.3-compat26.3.5-r3
Chainguardkeycloak-26.3-iamguarded-compat26.3.5-r7
Chainguardkeycloak-26.3-iamguarded-compatno fix
Chainguardkeycloak-26.426.4.4-r0
Chainguardkeycloak-26.4-compat26.4.2-r2
Chainguardkeycloak-26.4-iamguarded-compat26.4.5-r0
Chainguardkeycloak-26.4-operator26.4.2-r2
Chainguardkeycloak-26.4-operator-compat26.4.2-r2
Chainguardkeycloak-fips-26.2-iamguarded-fipsno fix
Chainguardkeycloak-fips-26.3-iamguarded-fips26.3.5-r8
Chainguardkeycloak-fips-26.3-iamguarded-fipsno fix
Chainguardkeycloak-fips-26.3-operator26.3.5-r4
Chainguardkeycloak-fips-26.3-operator-compat26.3.5-r4
Chainguardkeycloak-fips-26.426.4.4-r0
Chainguardkeycloak-fips-26.4-iamguarded-fips26.4.4-r0
Chainguardkeycloak-fips-26.4-operator26.4.4-r0
Chainguardkeycloak-fips-26.4-operator-compat26.4.4-r1
Wolfikeycloak-26.3-compat26.3.5-r3
Wolfikeycloak-26.426.4.4-r0
Wolfikeycloak-26.4-compat26.4.2-r2
Wolfikeycloak-26.4-iamguarded-compat26.4.5-r0
Wolfikeycloak-26.4-operator26.4.2-r2
Wolfikeycloak-26.4-operator-compat26.4.2-r2