StackRadarChart IndexLive demo

CVE-2024-1249

High

Advisory

Published 17 Apr 2024In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.4; base score, highest
EPSS: 0.004; 36th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 11; of 17,966 indexed, latest versions
Container images: 9; deployed by those charts
Fix available: 1 of 1; affected package

Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

Carried by container images the latest versions of 11 of 17,966 indexed charts deploy, on 9 images.

Affected package	Affected versions	Fixed in	Images
keycloak-servicesmaven	14.0.0, 17.0.1, 19.0.3, 20.0.1+4 more	22.0.10, 24.0.3	9

OSV records: GHSA-m6q9-p373-g5q8

Charts affected

11 by stars

Chart

Latest

Affected images

Radar Score

keycloakcodecentric

1 of 3 See more

keycloak codecentric 18.10.0

1 of the 3 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-services@17.0.1	22.0.10

Open the chart page →

7,922

musicocielmusicociel

1 of 3 See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-services@23.0.3	24.0.3

Open the chart page →

4,665

1 of 12 See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-services@20.0.5	22.0.10

Open the chart page →

39,787

keycloakaccount-service

1 of 2 See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-services@17.0.1	22.0.10

Open the chart page →

7,922

idmassist-iot-identity-manager

1 of 2 See more

idm assist-iot-identity-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-services@19.0.3	22.0.10

Open the chart page →

13,873

keycloakbhuwanupadhyay

1 of 2 See more

keycloak bhuwanupadhyay 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.2	5227edcc7595	keycloak-services@20.0.2	22.0.10

Open the chart page →

6,686

drogue-cloud-coredrogue-iot

1 of 22 See more

drogue-cloud-core drogue-iot 0.7.11

1 of the 22 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-services@20.0.5	22.0.10

Open the chart page →

57,761

drogue-cloud-twindrogue-iot

1 of 8 See more

drogue-cloud-twin drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-services@20.0.5	22.0.10

Open the chart page →

7,152

simple-keycloaksikalabs

1 of 1 See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-services@20.0.1	22.0.10

Open the chart page →

6,686

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-services@14.0.0	22.0.10

Open the chart page →

29,686

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2024-1249.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-services@20.0.3	22.0.10

Open the chart page →

6,258

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-services@20.0.5	22.0.10	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-services@17.0.1	22.0.10	2
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-services@19.0.3	22.0.10	1
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-services@20.0.5	22.0.10	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-services@14.0.0	22.0.10	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-services@23.0.3	24.0.3	1
quay.io/keycloak/keycloak :20.0.2	5227edcc7595	keycloak-services@20.0.2	22.0.10	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-services@20.0.1	22.0.10	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-services@20.0.3	22.0.10	1