CVE-2025-48374
mediumpriority · track · 0EPSS 0.002 · 8 %ileEUUSEPSS · scored 2026-10-27
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-c37v-3c8w-crq8zot logs secrets2025-05-22ghsa · osvUS
### Summary When using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. ### Details Container Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest Here is an example how the configuration can look which causes the above stated problem: ` http: address: "0.0.0.0" port: 5000 externalUrl: "https://zot.example.com" auth: { failDelay: 1, openid: { providers: { oidc: { name: "Keycloak", clientid: "zot-client-id", clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l, keypath: "", issuer: "https://keycloak.example.com/realms/example", scopes: ["openid"] } } } } ` ### PoC Set up a blank new zot k8s deployment with the code snippet above. ### Impact exposure of secrets, on configuring a oidc provider
- GO-2025-3705zot logs secrets in zotregistry.dev/zot2025-05-27vendor · osvUS
zot logs secrets in zotregistry.dev/zot
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15ecnnvd
- https://github.com/project-zot/zot/releasesPatchcnnvd
- https://github.com/project-zot/zot/security/advisories/GHSA-c37v-3c8w-crq8cnnvd
- https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15eenisa_euvd
- https://github.com/project-zot/zot/security/advisories/GHSA-c37v-3c8w-crq8enisa_euvd
- https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15envd
- https://github.com/project-zot/zot/security/advisories/GHSA-c37v-3c8w-crq8nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan