CVE-2026-17048 describes a security flaw in the Keycloak Admin REST API used by Red Hat Build of Keycloak. The vulnerability arises when the system handles requests for rotated client secrets stored in a secure vault. Because of improper boundary enforcement, delegated administrators who should only have view-only permissions can retrieve the actual resolved client secret rather than the placeholder value. This leads to exposure of sensitive credential information that should remain protected. The CVSS 3.1 base score is 5.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation level is currently indicated in the vendor advisory. There are no known exploits in the wild at this time.

The vulnerability allows unauthorized disclosure of sensitive client secrets to delegated administrators who only have view permissions. This exposure compromises confidentiality of credentials used to secure realms and clients in Keycloak. Although integrity and availability impacts are low or none, the confidentiality breach could facilitate further unauthorized access or misuse of the affected system's authentication mechanisms.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17048 for current remediation guidance. Until an official fix is available, restrict delegated administrator permissions carefully and monitor access to the Admin REST API to limit exposure. Follow any vendor recommendations once published.