{"id":"CVE-2025-48374","aliases":["GHSA-c37v-3c8w-crq8","GO-2025-3705"],"url":"https://o3.security/vulnerability/CVE-2025-48374","summary":"zot logs secrets","details":"### Summary\nWhen using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup.\n\n### Details\nContainer Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest\nHere is an example how the configuration can look which causes the above stated problem:\n\n`    http:\n      address: \"0.0.0.0\"\n      port: 5000\n      externalUrl: \"https://zot.example.com\"\n      auth: {\n        failDelay: 1,\n        openid: {\n          providers: {\n            oidc: {\n              name: \"Keycloak\",\n              clientid: \"zot-client-id\",\n              clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l,\n              keypath: \"\",\n              issuer: \"https://keycloak.example.com/realms/example\",\n              scopes: [\"openid\"]\n            }\n          }\n        }\n      }\n`\n\n### PoC\nSet up a blank new zot k8s deployment with the code snippet above.\n\n### Impact\nexposure of secrets, on configuring a oidc provider","published":"2025-05-22T20:43:13.708Z","modified":"2026-08-12T03:51:32.087077068Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"zotregistry.dev/zot","fixedVersion":"1.4.4-0.20250522160828-8a99a3ed231f"}],"fix":{"url":"https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15e","label":"project-zot/zot@8a99a3e"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48374.json"},{"type":"ADVISORY","url":"https://github.com/project-zot/zot/security/advisories/GHSA-c37v-3c8w-crq8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48374"},{"type":"FIX","url":"https://github.com/project-zot/zot/commit/8a99a3ed231fdcd8467e986182b4705342b6a15e"},{"type":"PACKAGE","url":"https://github.com/project-zot/zot"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-3705"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:32.087077068Z"}}