CVE-2025-14082
Fixed in a distro release EPSS <1%CVSS 2.7
A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint.
Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.11
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.5.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.2 | 26.2.5-r7 |
| Chainguard | keycloak-26.2-compat | 26.2.5-r7 |
| Chainguard | keycloak-26.2-iamguarded-compat | no fix |
| Chainguard | keycloak-26.3-compat | 26.3.5-r4 |
| Chainguard | keycloak-26.3-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4 | no fix |
| Chainguard | keycloak-26.4-compat | 26.4.7-r0 |
| Chainguard | keycloak-26.4-iamguarded-compat | no fix |
| Chainguard | keycloak-26.4-operator | 26.4.7-r0 |
| Chainguard | keycloak-26.4-operator-compat | 26.4.7-r0 |
| Chainguard | keycloak-fips-26.2 | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.2-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.3-operator | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-operator-compat | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.4 | no fix |
| Chainguard | keycloak-fips-26.4-iamguarded-fips | no fix |
| Chainguard | keycloak-fips-26.4-operator | 26.4.7-r12 |
| Chainguard | keycloak-fips-26.4-operator-compat | 26.4.7-r12 |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.4-iamguarded-fips | no fix |
| Wolfi | keycloak-26.3-compat | 26.3.5-r4 |
| Wolfi | keycloak-26.4 | no fix |
| Wolfi | keycloak-26.4-compat | 26.4.7-r0 |
| Wolfi | keycloak-26.4-iamguarded-compat | no fix |
| Wolfi | keycloak-26.4-operator | 26.4.7-r0 |
| Wolfi | keycloak-26.4-operator-compat | 26.4.7-r0 |