The vulnerability in Red Hat Build of Keycloak involves the default-groups REST endpoint and realm representation component responsible for managing groups automatically assigned to new users. A delegated administrator with realm-viewing permissions can see hidden default groups' names and identifiers without having explicit permissions to view those groups. This information disclosure flaw could lead to unintended exposure of internal group information. The CVSS v3.1 base score is 4.3, reflecting a low complexity attack vector with limited confidentiality impact and no integrity or availability impact. The vendor advisory does not specify a remediation level or patch availability.

The impact is limited to unauthorized information disclosure of hidden default group names and identifiers within a Keycloak realm. This could expose sensitive organizational or internal group structure information to delegated administrators who should not have such visibility. There is no reported impact on integrity or availability, and no known exploits in the wild have been documented.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16108 for current remediation guidance. Until an official fix is available, organizations should review delegated administrator permissions and limit realm-viewing roles where possible to reduce exposure. No vendor advisory states that no action is required or that the issue is already mitigated.