CVE-2020-1731

Name of the Vulnerable Software and Affected Versions Keycloak operator versions prior to 8.0.2

Description The issue is related to the Keycloak operator's failure to reset a randomly generated admin password after installation. This could allow a remote attacker to elevate their privileges. The problem arises because the operator generates a random admin password when installing Keycloak, but this password remains unchanged when deployed to the same OpenShift namespace.

Recommendations For versions prior to 8.0.2, update to version 8.0.2 or later to resolve the issue. As a temporary workaround, consider manually resetting the admin password after each deployment to the same OpenShift namespace to minimize the risk of exploitation.