CVE-2019-10170: Privilege Defined With Unsafe Actions in Keycloak
Summary
CVE-2019-10170: Privilege Defined With Unsafe Actions in Keycloak. Affects org.keycloak:keycloak-core versions < 8.0.0. Fixed in 8.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. The 'org.keycloak:keycloak-core' package is a core component of Keycloak that handles realm management and user permissions. It is commonly used in enterprise environments to secure web applications and APIs.
Vulnerability Detail
The Keycloak admin console allows the configuration of a script via the policy in the realm management interface. This flaw enables an attacker with authenticated user and realm management permissions to set a malicious script that can trigger and execute arbitrary code with the permissions of the application user. This vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Keycloak admin console to trusted administrators only. This can be achieved by implementing proper access controls and limiting the permissions of user accounts with realm management privileges.
Conclusion
The Keycloak vulnerability (CVE-2019-10170) allows an attacker to execute arbitrary code with the permissions of the application user. To mitigate this risk, it is crucial to upgrade the 'org.keycloak:keycloak-core' package to version 8.0.0 or later. Restricting access to the admin console can serve as a temporary workaround. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications.
The 'org.keycloak:keycloak-core' package is a core component of Keycloak that handles realm management and user permissions.
This vulnerability allows an attacker to execute arbitrary code with the permissions of the application user, potentially leading to unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, upgrade the 'org.keycloak:keycloak-core' package to version 8.0.0 or later.
As a temporary workaround, restrict access to the Keycloak admin console to trusted administrators only.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
