Bug 2561961 (CVE-2026-117688)

Summary: CVE-2026-117688 keycloak-services: keycloak-services: Vault secret disclosure via client registration installation configuration
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-27 13:28:02 UTC 
A sensitive information disclosure flaw was found in the org.keycloak.services.clientregistration component of Keycloak. The issue arises when Keycloak is configured with an active Vault provider and Dynamic Client Registration endpoints are enabled. An authenticated attacker holding a valid Registration Access Token (RAT) for a confidential client can update the client secret to a Vault reference expression, such as vault.alias. When the attacker subsequently requests the client installation configuration through the registration endpoint, Keycloak improperly resolves the Vault expression and returns the managed secret in plaintext. An attacker with knowledge of existing Vault secret aliases in the realm can exploit this to read arbitrary Vault values without possessing administrative privileges.