CVE-2026-107604: Keycloak Client Secret Disclosure Flaw

CVE-2026-107604 Overview

CVE-2026-107604 is an information disclosure vulnerability in the Keycloak identity and access management service. The flaw affects the installation provider and client registration endpoints. A realm administrator holding only the read-only view-clients role can retrieve the active primary secret of any confidential client. This secret should remain restricted to administrators with higher privileges. An attacker who obtains the secret can impersonate the client and reuse its service account permissions to access protected resources. The weakness is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A low-privileged realm administrator can read confidential client secrets and impersonate service accounts, bypassing the intended role-based access control boundary.

Affected Products

Red Hat build of Keycloak
Keycloak identity management service (installation provider endpoint)
Keycloak identity management service (client registration endpoint)

Discovery Timeline

2026-10-08 - CVE CVE-2026-107604 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-107604

Vulnerability Analysis

Keycloak exposes two endpoints that return client configuration data: the installation provider endpoint and the client registration endpoint. Both endpoints embed the active primary client secret in their responses for confidential clients. The access control check on these endpoints validates whether the caller holds a client-management role, but does not distinguish between read-only and write-level roles. As a result, a realm administrator assigned only view-clients can call these endpoints and retrieve secrets that should require manage-clients or equivalent privileges. The exposed secret authenticates the client to the token endpoint. An attacker can then request access tokens on behalf of the client's service account and reach any API protected by the roles assigned to that account.

Root Cause

The root cause is an authorization gap in the endpoints that generate client installation artifacts and registration metadata. The handlers treat view-clients as sufficient to return the full client representation, including the credential material. The design assumes any realm administrator should see client secrets, which conflicts with the read-only semantics advertised by the view-clients role.

Attack Vector

Exploitation requires an authenticated session with the view-clients role in the target realm. The attacker issues a standard HTTP request to the installation or client registration endpoint for a confidential client and parses the returned JSON or configuration file to extract the secret field. The attacker then uses that secret in a client_credentials grant request to obtain an access token tied to the client's service account. No user interaction is required and the request succeeds over the network.

Technical analysis of the affected code paths is available in the Red Hat CVE-2026-107604 Advisory and Red Hat Bug Report #2547941.

Detection Methods for CVE-2026-107604

Indicators of Compromise

Unexpected GET requests to /admin/realms/{realm}/clients/{id}/installation/providers/* from accounts holding only view-clients.
Calls to the client registration endpoint /realms/{realm}/clients-registrations/* returning payloads that include the secret field for confidential clients.
client_credentials token requests originating from IP addresses or user agents that have not previously authenticated as that client.
Service account activity against resource APIs that does not correlate with any legitimate workload schedule.

Detection Strategies

Audit Keycloak event logs for ADMIN_EVENT entries referencing installation providers or client registration operations initiated by accounts without manage-clients.
Correlate client secret retrievals with subsequent token issuance for the same client_id from a different source address.
Baseline normal callers of the installation and registration endpoints, then alert on deviations.

Monitoring Recommendations

Forward Keycloak admin and authentication events to a centralized log platform for retention and analytics.
Enable detailed admin event logging with request representations to capture which clients were queried.
Monitor the view-clients role assignments and flag any new grants until the environment is patched.

How to Mitigate CVE-2026-107604

Immediate Actions Required

Review all accounts assigned the view-clients role and revoke it from users who do not require client visibility.
Rotate the client secret of every confidential client in affected realms, since prior exposure cannot be ruled out.
Restrict network access to Keycloak admin endpoints to trusted management networks only.
Apply the vendor-supplied Keycloak update as soon as it is available for your distribution.

Patch Information

Refer to the Red Hat CVE-2026-107604 Advisory for the list of fixed packages and update instructions. The associated tracking entry is Red Hat Bug Report #2547941. Operators of upstream Keycloak should monitor the project's release notes for the corresponding version containing the authorization fix.

Workarounds

Avoid granting the view-clients role to any account that does not also require full client management.
Prefer fine-grained admin permissions over broad realm-management roles when possible.
Place Keycloak administrative APIs behind a reverse proxy that enforces source IP allowlisting and additional authentication.
Shorten service account token lifetimes to limit the window of abuse if a secret is exposed.

bash

# Configuration example: remove view-clients role from a user via kcadm
kcadm.sh remove-roles \
  -r <realm> \
  --uusername <admin-user> \
  --cclientid realm-management \
  --rolename view-clients

# Rotate the secret for a confidential client
kcadm.sh create clients/<client-uuid>/client-secret -r <realm>