CVE-2026-16104 describes a vulnerability in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue arises because sensitive configuration values, including reCAPTCHA secret keys, are not masked when accessed by administrators who have only view permissions. This flaw can result in the exposure of sensitive third-party service credentials to unauthorized personnel or through administrative logs. The CVSS 3.1 base score is 4.3 (medium severity), reflecting the confidentiality impact without integrity or availability impact. No known exploits are reported in the wild, and no patch or official fix has been published as of the advisory date.

The vulnerability allows unauthorized disclosure of sensitive configuration data, specifically third-party service credentials like reCAPTCHA secret keys, to administrators with view-only permissions. This could lead to credential leakage through direct access or administrative logs. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16104 for current remediation guidance. Until an official fix is available, restrict view-only administrative access to trusted personnel and avoid exposing sensitive configuration endpoints unnecessarily.