CVE-2025-11538
Medium · 6.8CVSS
6.8
EPSS
0.4%
Published
Nov 13, 2025
CISA due date
—
The record
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-quarkus-dist | 0 | 26.4.4 |
| Maven | org.keycloak:keycloak-quarkus-server | 0 | No fix |
| Chainguard | keycloak-26.2 | 0 | 26.2.5-r7 |
| Chainguard | keycloak-26.2-compat | 0 | 26.2.5-r6 |
| Chainguard | keycloak-26.2-iamguarded-compat | 0 | 26.2.5-r7 |
| Chainguard | keycloak-26.3 | 0 | 26.3.5-r4 |
| Chainguard | keycloak-26.3-compat | 0 | 26.3.5-r3 |
| Chainguard | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r4 |
| Chainguard | keycloak-fips-26.2 | 0 | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.2-iamguarded-fips | 0 | 26.2.5-r9 |
| Chainguard | keycloak-fips-26.3 | 0 | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-iamguarded-fips | 0 | 26.3.5-r5 |
| Chainguard | keycloak-fips-26.3-operator | 0 | 26.3.5-r4 |
| Chainguard | keycloak-fips-26.3-operator-compat | 0 | 26.3.5-r4 |
| Wolfi | keycloak-26.3 | 0 | 26.3.5-r4 |
| Wolfi | keycloak-26.3-compat | 0 | 26.3.5-r3 |
| Wolfi | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r4 |
Related vulnerabilities
- CVE-2025-11419 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-dist
- GHSA-q8hq-4h99-fj7x Keycloak TLS Client-Initiated Renegotiation Denial of Service Also affects org.keycloak:keycloak-quarkus-dist
- GHSA-gv3v-2cpp-3pmq Keycloak logs sensitive headers Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-11537 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- GHSA-v897-pv23-r8cw Keycloak has an improper input validation vulnerability Also affects org.keycloak:keycloak-quarkus-server
- CVE-2026-0976 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-10939 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-quarkus-server
- CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Also affects keycloak-26.2