CVE-2026-16108: Keycloak Information Disclosure Flaw

CVE-2026-16108 Overview

CVE-2026-16108 is an information disclosure vulnerability in Keycloak's default-groups REST endpoint and realm representation. The component manages groups automatically assigned to new users within a realm. A delegated administrator holding only realm-viewing permissions can enumerate the names and identifiers of hidden default groups. This occurs even when the administrator lacks the specific permissions required to view those groups. The exposure reveals internal organizational structures and sensitive group naming conventions to unauthorized principals.

Critical Impact
A low-privileged delegated administrator can enumerate hidden default group names and identifiers, exposing internal organizational structure without triggering authorization checks.

Affected Products

Red Hat Keycloak (see vendor advisory for specific versions)
Red Hat Single Sign-On (downstream distribution)
Red Hat Build of Keycloak

Discovery Timeline

2026-07-17 - CVE-2026-16108 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16108

Vulnerability Analysis

The flaw resides in the Keycloak default-groups REST endpoint and the realm representation logic. Keycloak enforces fine-grained authorization on group resources through per-group view permissions. The default-groups endpoint and the realm export representation bypass these per-group permission checks. Any principal with realm-viewing rights receives the group names and unique identifiers.

Delegated administration is a common Keycloak deployment pattern. Organizations grant scoped administrators visibility into realm metadata while restricting access to sensitive groups. This vulnerability breaks that trust boundary. Attackers gain reconnaissance data useful for lateral movement and social engineering. The disclosed identifiers can be reused in follow-up API calls to probe for additional authorization gaps. The weakness is categorized as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Root Cause

The default-groups endpoint returns group metadata without validating that the caller holds the view-group permission for each returned group. The realm representation serializer includes hidden default groups in its output. Both code paths trust the higher-level realm-view authorization as sufficient. They fail to filter results based on per-resource permissions.

Attack Vector

Exploitation requires network access to the Keycloak administration API and valid credentials for a delegated administrator account with realm-view rights. The attacker issues an authenticated GET request against the default-groups REST endpoint or requests the realm representation. The response contains names and UUIDs of default groups the caller should not see. No user interaction is required and complexity is low.

The vulnerability does not permit modification of group membership or configuration. Impact is limited to confidentiality of group metadata.

Detection Methods for CVE-2026-16108

Indicators of Compromise

Authenticated HTTP GET requests to /admin/realms/{realm}/default-groups originating from delegated administrator accounts that do not manage those groups.
Requests to /admin/realms/{realm} returning full realm representations to accounts scoped only to realm-view.
Unexpected enumeration patterns where a single administrative session queries multiple realms in rapid succession.

Detection Strategies

Enable Keycloak admin event logging and forward events to a centralized log platform for correlation.
Baseline expected callers of the default-groups endpoint and alert on deviations from that baseline.
Correlate realm-representation requests with the caller's assigned role scope to flag principals reading beyond their operational need.

Monitoring Recommendations

Ingest Keycloak audit and admin events into a SIEM and retain them for post-incident review.
Alert on repeated default-groups queries from the same session within short time windows.
Review delegated administrator role assignments quarterly to confirm least-privilege scoping.

How to Mitigate CVE-2026-16108

Immediate Actions Required

Apply the vendor patch referenced in the Red Hat CVE-2026-16108 Advisory once available for your distribution.
Audit all delegated administrator accounts and remove realm-view rights from principals that do not require them.
Review default group naming conventions and rename groups whose names themselves reveal sensitive organizational data.

Patch Information

Refer to the Red Hat CVE-2026-16108 Advisory and Red Hat Bugzilla Ticket #2501740 for fixed package versions and errata. Apply updates through your standard package manager and restart the Keycloak service after patching.

Workarounds

Restrict access to the Keycloak administration API at the network layer to trusted management subnets only.
Reduce the number of accounts holding realm-view permissions until the patch is deployed.
Avoid embedding sensitive information in default group names so that any accidental disclosure has minimal impact.

bash

# Example: revoke realm-view role from a delegated admin using kcadm.sh
/opt/keycloak/bin/kcadm.sh remove-roles \
  --uusername delegated-admin \
  --rolename view-realm \
  -r target-realm