StackRadarChart IndexLive demo

CVE-2025-13467

Medium

Advisory

Published 19 Dec 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 19; of 17,781 indexed, latest versions
Container images: 16; deployed by those charts
Fix available: 1 of 1; affected package

Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 16 images.

Affected package	Affected versions	Fixed in	Images
keycloak-ldap-federationmaven	14.0.0, 17.0.1, 19.0.3, 20.0.1+10 more	26.2.11, 26.4.6	16

OSV records: GHSA-4hx9-48xh-5mxr

Charts affected

19 by stars

Chart

Latest

Affected images

Radar Score

keycloakcodecentric

1 of 3 See more

keycloak codecentric 18.10.0

1 of the 3 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-ldap-federation@17.0.1	26.2.11

Open the chart page →

7,713

musicocielmusicociel

1 of 3 See more

musicociel musicociel 0.0.0

1 of the 3 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-ldap-federation@23.0.3	26.2.11

Open the chart page →

4,406

1 of 12 See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-ldap-federation@20.0.5	26.2.11

Open the chart page →

37,373

keycloakaccount-service

1 of 2 See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-ldap-federation@17.0.1	26.2.11

Open the chart page →

7,713

arlas-aiasarlas-stack

1 of 22 See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	keycloak-ldap-federation@26.3.3	26.4.6

Open the chart page →

40,238

idmassist-iot-identity-manager

1 of 2 See more

idm assist-iot-identity-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-ldap-federation@19.0.3	26.2.11

Open the chart page →

13,352

keycloakbarravar

1 of 1 See more

keycloak barravar 1.0.4

1 of the 1 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	keycloak-ldap-federation@24.0.3	26.2.11

Open the chart page →

2,381

drogue-cloud-coredrogue-iot

1 of 22 See more

drogue-cloud-core drogue-iot 0.7.11

1 of the 22 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-ldap-federation@20.0.5	26.2.11

Open the chart page →

55,666

drogue-cloud-twindrogue-iot

1 of 8 See more

drogue-cloud-twin drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-ldap-federation@20.0.5	26.2.11

Open the chart page →

6,915

opencloudjacobcolvin

1 of 13 See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	keycloak-ldap-federation@26.1.4	26.2.11

Open the chart page →

45,239

1 of 29 See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	keycloak-ldap-federation@24.0.4	26.2.11

Open the chart page →

15,369

keycloakpascaliske

1 of 1 See more

keycloak pascaliske 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	keycloak-ldap-federation@26.0.7	26.2.11

Open the chart page →

2,097

keycloaksb-helm-charts

1 of 2 See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	keycloak-ldap-federation@26.0.6	26.2.11

Open the chart page →

2,590

keycloaksikalabs

1 of 1 See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	keycloak-ldap-federation@26.3.3	26.4.6

Open the chart page →

1,690

simple-keycloaksikalabs

1 of 1 See more

simple-keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-ldap-federation@20.0.1	26.2.11

Open the chart page →

6,443

wonder-mesh-netstrrl-helm

1 of 3 See more

wonder-mesh-net strrl-helm 2026.629.0

1 of the 3 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.0	09a381c715ab	keycloak-ldap-federation@26.0.8	26.2.11

Open the chart page →

5,063

opencloudunxwares

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	keycloak-ldap-federation@26.1.4	26.2.11

Open the chart page →

45,239

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-ldap-federation@14.0.0	26.2.11

Open the chart page →

28,605

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-13467.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-ldap-federation@20.0.3	26.2.11

Open the chart page →

6,016

Container images carrying it

16 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :26.1.4	044a457e0498	keycloak-ldap-federation@26.1.4	26.2.11	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	keycloak-ldap-federation@20.0.5	26.2.11	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	keycloak-ldap-federation@17.0.1	26.2.11	2
assistiot/identity-manager_kc :latest	0df4b4fa899a	keycloak-ldap-federation@19.0.3	26.2.11	1
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	keycloak-ldap-federation@20.0.5	26.2.11	1
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	keycloak-ldap-federation@24.0.4	26.2.11	1
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	keycloak-ldap-federation@26.3.3	26.4.6	1
quay.io/keycloak/keycloak :26.0	09a381c715ab	keycloak-ldap-federation@26.0.8	26.2.11	1
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	keycloak-ldap-federation@14.0.0	26.2.11	1
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	keycloak-ldap-federation@26.0.7	26.2.11	1
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	keycloak-ldap-federation@24.0.3	26.2.11	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	keycloak-ldap-federation@23.0.3	26.2.11	1
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	keycloak-ldap-federation@26.3.3	26.4.6	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	keycloak-ldap-federation@20.0.1	26.2.11	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	keycloak-ldap-federation@26.0.6	26.2.11	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	keycloak-ldap-federation@20.0.3	26.2.11	1