Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api (CVE-2026-17048)

CVE-2026-17048 describes a security flaw in the Keycloak Admin REST API where a delegated administrator with view-only permissions can retrieve actual resolved client secrets instead of vault placeholders. This happens because the system does not properly enforce boundaries when processing requests for rotated client secrets stored in a secure vault. The vulnerability exposes sensitive credentials that could compromise security realms and clients managed by Keycloak. Red Hat has issued security advisories and patches for their build of Keycloak 26.6.6 to fix this issue.

The vulnerability leads to the exposure of sensitive rotated client secrets to users who should only have view-only access, potentially compromising authentication and authorization mechanisms managed by Keycloak. This could allow unauthorized access to protected resources if the leaked secrets are exploited. However, there are no reports of active exploitation in the wild at this time.

A patch is available and should be applied. Red Hat has released updated packages for their build of Keycloak version 26.6.6 that address this vulnerability. Users should upgrade to the fixed version or later to remediate the issue. Before updating, back up existing installations, including configurations and databases. No additional mitigation actions are specified by the vendor.