CVE-2026-17048 Overview
CVE-2026-17048 is an information disclosure vulnerability in the Keycloak Admin REST API. The flaw affects how Keycloak processes requests for rotated client secrets stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the resolved secret value rather than the expected vault placeholder. This exposes sensitive client credentials to accounts that should not have access to them. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability requires authenticated access with high privileges (delegated admin), which limits mass exploitation but presents a meaningful privilege boundary violation risk in multi-tenant realms.
Critical Impact
A delegated administrator with view-only access can obtain plaintext client secrets from the vault through the Keycloak Admin REST API, breaking least-privilege separation and enabling downstream authentication against affected clients.
Affected Products
- Red Hat Keycloak (Admin REST API component)
- Red Hat Build of Keycloak
- Downstream distributions incorporating the affected Keycloak Admin REST API code path
Discovery Timeline
- 2026-07-24 - CVE-2026-17048 published to the National Vulnerability Database (NVD)
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2026-17048
Vulnerability Analysis
Keycloak supports storing sensitive client configuration values, such as client secrets, in an external vault. Administrators typically see a vault placeholder string (for example, ${vault.client-secret}) rather than the resolved secret. The Admin REST API endpoint responsible for returning client credential representations fails to enforce this abstraction consistently when a client secret has been rotated. Under this condition, the API resolves the vault reference server-side and returns the actual credential in the response payload. Any authenticated user holding the delegated view-clients role can trigger the code path and read the resolved value, which violates the intended read-only privilege boundary.
Root Cause
The root cause is improper boundary enforcement between the vault-resolution layer and the API serialization layer for rotated client secrets. The response builder returns the resolved secret instead of preserving the placeholder marker before the object is serialized to the caller. This is an information exposure defect [CWE-200], not a memory-safety or injection issue.
Attack Vector
Exploitation requires network access to the Keycloak Admin REST API and valid credentials for an account with delegated administrative permissions on a realm or client scope. The attacker issues an authenticated HTTP request against the affected client endpoint after a secret rotation has occurred. The API returns the plaintext secret in the JSON response. No user interaction and no additional privilege escalation step are required beyond the initial delegated-admin access.
No public proof-of-concept exploit is available. Refer to the Red Hat CVE-2026-17048 Advisory and Red Hat Bugzilla Report #2506743 for authoritative technical details.
Detection Methods for CVE-2026-17048
Indicators of Compromise
- Authenticated GET requests from delegated administrator accounts against /admin/realms/{realm}/clients/{id} or /admin/realms/{realm}/clients/{id}/client-secret endpoints immediately after a secret rotation event.
- Response payloads from the Admin REST API that contain resolved secret values instead of ${vault.*} placeholder strings.
- Unusual volumes of client-secret read operations by accounts holding only view-clients or equivalent view-only roles.
Detection Strategies
- Enable Keycloak admin event logging and alert on CLIENT_INFO and CLIENT_UPDATE events performed by accounts without full realm-management privileges.
- Correlate secret rotation events with subsequent client read operations to identify accounts pulling freshly rotated secrets.
- Baseline expected Admin REST API consumers and flag deviations, particularly service accounts or delegated admins reading credential fields.
Monitoring Recommendations
- Forward Keycloak admin events and audit logs to a centralized SIEM for retention and correlation.
- Monitor vault backend access logs for read patterns that align in time with Admin REST API traffic from view-only accounts.
- Track authentication anomalies against downstream clients whose secrets may have been exposed, particularly failed-then-successful login sequences from new source addresses.
How to Mitigate CVE-2026-17048
Immediate Actions Required
- Review all delegated administrator role assignments and remove view-clients or equivalent permissions from accounts that do not strictly require them.
- Rotate any client secrets that may have been exposed to delegated administrators since the last vault rotation.
- Apply the vendor patch as soon as it is available from Red Hat for your Keycloak distribution.
- Audit Admin REST API access logs for prior reads of rotated client secrets by view-only accounts.
Patch Information
Consult the Red Hat CVE-2026-17048 Advisory for fixed package versions and errata specific to your Red Hat Build of Keycloak deployment. Track Red Hat Bugzilla Report #2506743 for remediation status updates. Apply updates through your standard package management channel and restart the Keycloak service to load patched code paths.
Workarounds
- Restrict access to the Keycloak Admin REST API at the network layer to trusted management networks and jump hosts.
- Avoid delegating client-view permissions to accounts outside the core identity administration team until the patch is applied.
- Defer client-secret rotations that rely on vault placeholders until the fix is deployed, or perform rotations only when delegated-admin sessions are disabled.
- Enable strict admin event logging and alerting to detect any read of client credentials by non-privileged administrators.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
