CVE-2024-10973Medium· 5.7▾ Sunlit

A vulnerability was found in Keycloak

A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent n…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score31/ 100 · Low

impact 31.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 17, 2024

Updated

Aug 4, 2026

CVSS

5.7

Vendor

—

Product

—

CWE

CWE-319

Depth score

31 · Low

EPSS

0.27% · p19

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 595 days

Dec 17, 2024Published
Disclosed via NVD
Aug 4, 2026Record revised
Last analysed / modified upstream
Aug 4, 2026EPSS first tracked
0.3%

CWE-319 #nvd

Full technical detail▾

Overview

A vulnerability was found in Keycloak. The environment option KC_CACHE_EMBEDDED_MTLS_ENABLED does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed