CVE-2026-107604: Exposure of Sensitive Information to an Unauthorized Actor in Red Hat Red Hat Build of Keycloak

A security flaw in Red Hat Build of Keycloak's installation provider and client registration endpoints allows a realm administrator possessing only the read-only view-clients role to retrieve the active primary secret of any confidential client. This secret is intended to be restricted but is exposed due to this vulnerability. An attacker with this access could impersonate the client and gain unauthorized access to permissions associated with the client's service account. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor advisory is available but does not specify patch or remediation status.

The vulnerability allows unauthorized disclosure of confidential client secrets to a realm administrator with limited read-only privileges. This exposure can lead to client impersonation and unauthorized access to service account permissions, potentially compromising services relying on these credentials. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-107604 for current remediation guidance. Until an official fix is available, restrict realm administrator roles to trusted personnel and monitor access to client secrets carefully.