StackRadarChart IndexLive demo

CVE-2024-4028

Low

Advisory

Published 18 Feb 2025In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 3.8; base score, highest
EPSS: 0.003; 23rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 23; of 17,781 indexed, latest versions
Container images: 21; deployed by those charts
Fix available: None; affected package

Keycloak allows cross-site scripting (XSS)

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 21 images.

Affected package	Affected versions	Fixed in	Images
keycloak-coremaven	3.4.0.Final, 12.0.4, 13.0.1, 14.0.0+16 more	no fix listed	21

OSV records: GHSA-q4xq-445g-g6ch

Charts affected

23 by stars

Chart

Latest

Affected images

Radar Score

keycloakcodecentric

1 of 3 See more

keycloak codecentric 18.10.0

1 of the 3 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-core@17.0.1	no fix listed

Open the chart page →

7,713

microcksmicrocks

0.8.0-helm-3.kube-1.17

1 of 5 See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
microcks/microcks :0.8.0	e3a3e0c67b09	keycloak-core@3.4.0.Final	no fix listed

Open the chart page →

10,732

musicocielmusicociel

1 of 3 See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-core@23.0.3	no fix listed

Open the chart page →

4,406

1 of 12 See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-core@20.0.5	no fix listed

Open the chart page →

37,373

shinyproxyremche

1 of 2 See more

shinyproxy remche 0.6.6

1 of the 2 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
remche/shinyproxy :2.6.1	8bcda8a04d3b	keycloak-core@13.0.1	no fix listed

Open the chart page →

3,958

keycloakaccount-service

1 of 2 See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-core@17.0.1	no fix listed

Open the chart page →

7,713

idmassist-iot-identity-manager

1 of 2 See more

idm assist-iot-identity-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-core@19.0.3	no fix listed

Open the chart page →

13,352

keycloakbarravar

1 of 1 See more

keycloak barravar 1.0.4

1 of the 1 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	keycloak-core@24.0.3	no fix listed

Open the chart page →

2,381

damap-chartdamap

1 of 5 See more

damap-chart damap 0.3.0

1 of the 5 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
ghcr.io/damap-org/damap-backend :5.0.0	f3d0c7d35498	keycloak-core@23.0.7	no fix listed

Open the chart page →

13,936

drogue-cloud-coredrogue-iot

1 of 22 See more

drogue-cloud-core drogue-iot 0.7.11

1 of the 22 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-core@20.0.5	no fix listed

Open the chart page →

55,666

drogue-cloud-twindrogue-iot

1 of 8 See more

drogue-cloud-twin drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-core@20.0.5	no fix listed

Open the chart page →

6,915

geonetwork-k8sgeonetwork-k8s

1 of 5 See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
jingking/geonetwork-hnap :4.2.8	43e74ab234e1	keycloak-core@18.0.2	no fix listed

Open the chart page →

34,754

keycloak-application-platform-configkvalitetsit

1 of 1 See more

keycloak-application-platform-config kvalitetsit 0.0.29

1 of the 1 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
adorsys/keycloak-config-cli :6.1.6-25.0.1	eb49a2dcbbb8	keycloak-core@25.0.1	no fix listed

Open the chart page →

3,334

1 of 29 See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	keycloak-core@24.0.4	no fix listed

Open the chart page →

15,369

file-system-ms-helm-chartnotesprojectchart

1 of 2 See more

file-system-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	keycloak-core@19.0.1	no fix listed

Open the chart page →

5,875

apicurioone-acre-fund

1 of 5 See more

apicurio one-acre-fund 2.3.0

1 of the 5 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	keycloak-core@22.0.3	no fix listed

Open the chart page →

18,667

keycloakpascaliske

1 of 1 See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	keycloak-core@26.0.7	no fix listed

Open the chart page →

2,097

keycloaksb-helm-charts

1 of 2 See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	keycloak-core@26.0.6	no fix listed

Open the chart page →

2,590

simple-keycloaksikalabs

1 of 1 See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-core@20.0.1	no fix listed

Open the chart page →

6,443

wonder-mesh-netstrrl-helm

1 of 3 See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0	09a381c715ab	keycloak-core@26.0.8	no fix listed

Open the chart page →

5,063

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	keycloak-core@12.0.4	no fix listed

Open the chart page →

12,455

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-core@14.0.0	no fix listed

Open the chart page →

28,605

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2024-4028.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-core@20.0.3	no fix listed

Open the chart page →

6,016

Container images carrying it

21 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-core@20.0.5	no fix listed	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-core@17.0.1	no fix listed	2
adorsys/keycloak-config-cli :6.1.6-25.0.1	eb49a2dcbbb8	keycloak-core@25.0.1	no fix listed	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	keycloak-core@12.0.4	no fix listed	1
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	keycloak-core@22.0.3	no fix listed	1
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-core@19.0.3	no fix listed	1
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-core@20.0.5	no fix listed	1
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	keycloak-core@24.0.4	no fix listed	1
jingking/geonetwork-hnap :4.2.8	43e74ab234e1	keycloak-core@18.0.2	no fix listed	1
microcks/microcks :0.8.0	e3a3e0c67b09	keycloak-core@3.4.0.Final	no fix listed	1
remche/shinyproxy :2.6.1	8bcda8a04d3b	keycloak-core@13.0.1	no fix listed	1
vlebediantsev/file-system-ms-final :latest	10393a89b4a8	keycloak-core@19.0.1	no fix listed	1
ghcr.io/damap-org/damap-backend :5.0.0	f3d0c7d35498	keycloak-core@23.0.7	no fix listed	1
quay.io/keycloak/keycloak :26.0	09a381c715ab	keycloak-core@26.0.8	no fix listed	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-core@14.0.0	no fix listed	1
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	keycloak-core@26.0.7	no fix listed	1
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	keycloak-core@24.0.3	no fix listed	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-core@23.0.3	no fix listed	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-core@20.0.1	no fix listed	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	keycloak-core@26.0.6	no fix listed	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-core@20.0.3	no fix listed	1