CVE-2026-17048CWE-200information-disclosure

CVE-2026-17048

Medium · published July 24, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-24T18:16Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_keycloakall versions—
References (4)
https://access.redhat.com/errata/RHSA-2026:56523 · [email protected]https://access.redhat.com/errata/RHSA-2026:56524 · [email protected]https://access.redhat.com/security/cve/CVE-2026-17048 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2506743 · [email protected]
EPSS history
Timeline
  • 24 JUL 13:41Z
    Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
    cvelistv5