CVE-2020-14359

highpriority · track · 29EPSS 0.009 · 60 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.93% (60th) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.7–7.5

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lprimary · NVD / NIST USexploitability 3.9 · impact 3.4

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · OSV

v3.16.7mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-305USCWE-305US

affected products (3)

Products and version ranges known to be affected.

n/a KeyCloak≤ all versions as of 2021-02-22enisa_euvdEU
redhat louketo proxyall versionsnvdUScpe:2.3:a:redhat:louketo_proxy:*:*:*:*:*:*:*:*
Go github.com/keycloak/keycloak-gatekeeper≤ 1.2.8osvUSpkg:golang/github.com/keycloak/keycloak-gatekeeper

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-jh6m-3pqw-242hKeycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers2022-02-09ghsa · osvUS
A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2021-02-23modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=1868591 cnnvd
https://issues.jboss.org/browse/KEYCLOAK-14090 cnnvd
https://nvd.nist.gov/vuln/detail/CVE-2020-14359 cnnvd
https://bugzilla.redhat.com/show_bug.cgi?id=1868591 enisa_euvd
https://issues.jboss.org/browse/KEYCLOAK-14090 enisa_euvd
https://bugzilla.redhat.com/show_bug.cgi?id=1868591Issue TrackingVendor Advisorynvd
https://issues.jboss.org/browse/KEYCLOAK-14090Issue TrackingPermissions RequiredThird Party Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan