CVE-2026-17048: Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
Other sources
A sensitive information disclosure flaw was found in the Keycloak Admin REST API. The vulnerability exists in the GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated endpoint. When a confidential client is configured to use a vault-backed rotated secret (e.g., using a placeholder like ${vault.rotated-secret}), the endpoint returns the resolved plaintext value from the vault instead of the placeholder string. This issue specifically affects the rotated secret and not the primary client secret. Exploitation requires the attacker to have high privileges, specifically the realm-management:view-clients role. A successful attack allows a delegated administrator to bypass vault security boundaries and obtain usable client credentials, which could be used to impersonate the affected client.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17048?
The severity of CVE-2026-17048 is medium, rated at 5.5.
What type of vulnerability is CVE-2026-17048?
CVE-2026-17048 is an information leak vulnerability affecting the Keycloak Admin REST API.
How does CVE-2026-17048 affect Keycloak services?
CVE-2026-17048 allows delegated administrators to access leaked rotated client secrets via the admin REST API.
What is the risk associated with CVE-2026-17048?
The risk level for CVE-2026-17048 is quantified as 39, indicating a significant security concern.
How can I remediate CVE-2026-17048?
Remediation for CVE-2026-17048 involves updating Keycloak to a version that fixes the boundary enforcement issues in the Admin REST API.