CVE-2026-16104: Keycloak Information Disclosure Flaw

CVE-2026-16104 Overview

CVE-2026-16104 is an information disclosure vulnerability in the keycloak-services component of Red Hat Build of Keycloak. The authentication configuration endpoint fails to mask sensitive configuration values, including reCAPTCHA secret keys, when accessed by administrators holding view-only permissions. This allows lower-privileged administrators to read third-party service credentials that should be redacted. Exposed credentials can also propagate into administrative logs, extending the disclosure surface beyond the initial request. The flaw is classified under CWE-522: Insufficiently Protected Credentials.

Critical Impact
A low-privileged administrator can retrieve plaintext third-party credentials (such as reCAPTCHA secrets) from Keycloak configuration responses, enabling abuse of integrated services and lateral compromise of dependent systems.

Affected Products

Red Hat Build of Keycloak
Keycloak keycloak-services component (authentication configuration endpoint)
Downstream identity and access management deployments using affected Keycloak versions

Discovery Timeline

2026-07-17 - CVE-2026-16104 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-16104

Vulnerability Analysis

The vulnerability resides in the authentication configuration endpoint exposed by the keycloak-services module. Keycloak allows administrators to configure authenticator flows that integrate third-party services, such as Google reCAPTCHA, which require secret keys. When an administrator with view-only permissions requests the current configuration, the server returns the raw configuration payload. The response does not apply masking or redaction to fields marked as sensitive, so secret values are transmitted in cleartext to any principal with read access to the configuration.

The access vector is network-based and authenticated, requiring only low privileges. No user interaction is needed, and the impact is limited to confidentiality of configuration data. Because Keycloak commonly logs administrative API responses for audit purposes, the same secrets may also appear in administrative log streams, expanding exposure to log aggregation systems and any operator with log access.

Root Cause

The root cause is missing output filtering on the configuration serialization path in keycloak-services. Fields designated as secrets, such as the reCAPTCHA secret key, are not annotated or handled by a masking routine before serialization. Read-only administrative roles inherit the same visibility into configuration values as roles authorized to manage them, violating the principle of least privilege for credential exposure ([CWE-522]).

Attack Vector

An attacker requires an authenticated Keycloak account with view permissions on authentication configurations. The attacker issues a standard administrative API request against the authentication configuration endpoint and parses the returned JSON payload for secret fields. Recovered credentials, such as reCAPTCHA server-side secrets, can then be reused to bypass bot protections, abuse quota, or forge legitimate integration traffic against dependent services.

No verified public exploit code is available. See the Red Hat CVE Advisory and Red Hat Bug Report for authoritative technical details.

Detection Methods for CVE-2026-16104

Indicators of Compromise

Administrative API requests to authentication configuration endpoints under /admin/realms/{realm}/authentication/config/ originating from view-only accounts.
Keycloak audit or server logs containing plaintext values in configuration fields that should be masked, such as reCAPTCHA secret.
Unexpected reuse of third-party integration credentials from IP addresses not associated with the Keycloak service.

Detection Strategies

Review Keycloak admin event logs for ACTION=VIEW events against authentication configuration resources performed by non-administrative roles.
Scan centralized log stores for regex matches on known secret formats (for example, Google reCAPTCHA keys) appearing in Keycloak log streams.
Correlate third-party service abuse alerts (reCAPTCHA failure spikes, quota anomalies) with recent view access to Keycloak authentication configuration.

Monitoring Recommendations

Enable detailed admin event logging in Keycloak and forward events to a SIEM for retention and analysis.
Alert on any account without manage-authorization or manage-realm roles that queries authentication configuration endpoints.
Rotate and monitor all third-party integration credentials referenced in Keycloak authenticator configurations.

How to Mitigate CVE-2026-16104

Immediate Actions Required

Apply the vendor-supplied Keycloak update as soon as it is available from Red Hat. Track fix status via the Red Hat CVE Advisory.
Rotate all third-party secrets (reCAPTCHA keys, and any other secrets stored in authenticator configurations) that may have been exposed to view-only administrators.
Audit realm role assignments and remove unnecessary view permissions on authentication configuration resources.

Patch Information

Refer to the Red Hat CVE Advisory for CVE-2026-16104 for fixed component versions and errata. The Red Hat Bugzilla entry 2501737 tracks upstream remediation of the missing masking logic in keycloak-services.

Workarounds

Restrict the view-authorization and equivalent read-only roles to a minimal set of trusted operators until the patch is applied.
Sanitize Keycloak log pipelines to redact fields matching known secret patterns before they reach shared log storage.
Move sensitive integrations to secret management systems where feasible, so Keycloak stores only references rather than raw secret values.

bash

# Configuration example: audit which principals hold view access on authentication config
# Requires kcadm.sh authenticated as a realm administrator
kcadm.sh get roles -r <realm> --fields name,composite
kcadm.sh get users -r <realm> -q briefRepresentation=true \
  | jq '.[] | select(.attributes.roles != null)'

# Rotate exposed reCAPTCHA secret after patching
kcadm.sh update authentication/config/<config-id> -r <realm> \
  -s 'config."secret"=<new-recaptcha-secret>'