CVE-2026-17048
Received Received - Intake

Keycloak Admin REST API Secret Exposure via Vault Access

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Red Hat, Inc.

Description
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-17048
EUVD
EUVD-2026-48587

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a sensitive information disclosure flaw in the Keycloak Admin REST API. It occurs when the system processes requests for rotated client secrets stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual secret instead of the vault placeholder, exposing sensitive credentials.

Detection Guidance

To detect this vulnerability, monitor Keycloak Admin REST API logs for requests to the GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated endpoint. Check if the response contains plaintext secrets instead of vault placeholders like ${vault.rotated-secret}.

Impact Analysis

A successful attack could allow a delegated administrator to bypass vault security boundaries and obtain usable client credentials. This may enable impersonation of the affected client, potentially leading to unauthorized access or actions within the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive credentials. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. The flaw allows unauthorized access to client secrets, potentially violating confidentiality requirements.

Mitigation Strategies

Immediately restrict access to the affected endpoint by removing the realm-management:view-clients role from delegated administrators. Update Keycloak to the latest patched version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart