CVE-2025-9162: 
Java vulnerability analysis and mitigation

CVE-2025-9162 is a security vulnerability discovered in org.keycloak/keycloak-model-storage-service, specifically affecting the KeycloakRealmImport custom resource. The vulnerability was disclosed on August 21, 2025, and primarily impacts the Keycloak environment. This flaw involves the substitution of placeholders within imported realm documents that can reference environment variables (Red Hat CVE, NVD).

The vulnerability stems from the KeycloakRealmImport custom resource's functionality that substitutes placeholders within imported realm documents. The flaw has been assigned a CVSS v3.1 base score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. It is categorized under CWE-526 (Exposure of Sensitive Information Through Environmental Variables) (Red Hat CVE).

The vulnerability can lead to unintended consequences within the Keycloak environment. When exploited, an attacker can inject malicious content during the realm import procedure, potentially exposing sensitive information through environment variables (Red Hat CVE).

According to Red Hat, mitigation options for this vulnerability are either not available or do not meet their Product Security criteria for ease of use, deployment, applicability to widespread installation base, or stability (Red Hat CVE).