The vulnerability exists in the Keycloak Admin REST API used for managing security realms and clients. When handling requests for rotated client secrets stored in a secure vault, the system improperly enforces access boundaries. As a result, delegated administrators with only view permissions can access the resolved client secret instead of the vault placeholder, leading to exposure of sensitive information. This flaw impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 5.5, indicating a medium severity level. No patch or official remediation level has been published yet by Red Hat. The vendor advisory is available but does not specify a fix status.

Sensitive client secrets stored in a secure vault can be exposed to delegated administrators who should only have view-only permissions. This compromises the confidentiality of these credentials, potentially allowing unauthorized use of client secrets. There is no indication of impact on system integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17048 for current remediation guidance. Until an official fix is released, restrict delegated administrator permissions and monitor access to the Admin REST API to limit exposure. Avoid granting view-only permissions to untrusted users for sensitive client secret management.