Bug 2506743 (CVE-2026-17048)
| Summary: | CVE-2026-17048 keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
A sensitive information disclosure flaw was found in the Keycloak Admin REST API. The vulnerability exists in the GET /admin/realms/{realm}/clients/{clientUuid}/client-secret/rotated endpoint. When a confidential client is configured to use a vault-backed rotated secret (e.g., using a placeholder like ${vault.rotated-secret}), the endpoint returns the resolved plaintext value from the vault instead of the placeholder string. This issue specifically affects the rotated secret and not the primary client secret. Exploitation requires the attacker to have high privileges, specifically the realm-management:view-clients role. A successful attack allows a delegated administrator to bypass vault security boundaries and obtain usable client credentials, which could be used to impersonate the affected client.