Information disclosure in Keycloak - CVE-2026-17048
Published: September 10, 2026
Vulnerability identifier: #VU148958
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-17048
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive credentials.
The vulnerability exists due to improper boundary enforcement in the Keycloak Admin REST API when processing requests for rotated client secrets stored in a secure vault. A remote privileged user can retrieve resolved secrets instead of vault placeholders to disclose sensitive credentials.
Exploitation requires delegated administrator permissions that are limited to viewing resources.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-17048
Install security update from vendor's website.
Keycloak - update to 26.7.2
Red Hat build of Keycloak - update to 26.6.6
Red Hat build of Keycloak - update to 26.6.6