CVE-2026-89298 Overview
CVE-2026-89298 is an information disclosure vulnerability in the Dynamic Client Registration service of Keycloak, an open-source identity and access management platform. The flaw allows an authenticated user with the view-clients role to retrieve client details through the client registration endpoint. Keycloak fails to mask sensitive fields in the response, returning the client's confidential secret in cleartext. A read-only administrator can use this exposed secret to authenticate as the affected client and escalate privileges within the realm. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
A read-only administrator holding the view-clients role can obtain client secrets in cleartext and gain full access to affected client accounts, enabling privilege escalation within the Keycloak realm.
Affected Products
- Red Hat Keycloak (see Red Hat CVE-2026-89298 Advisory)
- Red Hat build of Keycloak
- Upstream Keycloak identity and access management server
Discovery Timeline
- 2026-09-11 - CVE-2026-89298 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89298
Vulnerability Analysis
The vulnerability resides in Keycloak's Dynamic Client Registration service. When a user with the view-clients role requests client details from the client registration endpoint, the service returns the full client representation without redacting confidential fields. The client secret, which should be treated as a credential equivalent to a password, is included in the response in cleartext.
The view-clients role is intended as a read-only administrative role for inspecting client configuration metadata. It should not grant access to credentials that permit authentication as the client. By exposing the secret, the endpoint effectively converts a limited read permission into full impersonation capability for every client in the realm.
An attacker holding this role can enumerate clients, harvest their secrets, and then authenticate to protected resources or the token endpoint as those clients. Depending on the client's assigned service account roles, this can lead to lateral movement within the identity realm and access to downstream applications relying on Keycloak for authentication.
Root Cause
The root cause is a failure to apply output sanitization on the client representation returned by the Dynamic Client Registration endpoint. Sensitive attributes such as the client secret are not masked or removed before serialization, violating the principle of least disclosure for read-only roles.
Attack Vector
Exploitation requires an authenticated session with the view-clients role. The attacker sends a standard HTTP GET request to the client registration endpoint for a target client identifier. The response body contains the cleartext client secret, which the attacker then uses in a subsequent OAuth 2.0 client_credentials grant or similar flow to obtain tokens as that client. No user interaction is required, and the attack is executed entirely over the network. Refer to the Red Hat Bug Report #2531871 for additional technical detail.
Detection Methods for CVE-2026-89298
Indicators of Compromise
- Unexpected HTTP GET requests to /realms/{realm}/clients-registrations/ endpoints originating from accounts assigned only the view-clients role.
- Enumeration patterns showing sequential or bulk retrieval of client configuration from the Dynamic Client Registration endpoint.
- OAuth client_credentials token requests from source IP addresses or user agents not previously associated with the client.
Detection Strategies
- Audit Keycloak event logs for CLIENT_INFO and CLIENT_REGISTRATION events tied to read-only administrator accounts.
- Correlate client registration reads with subsequent authentication events using the same client_id from unfamiliar sources.
- Alert on any use of the view-clients role to access endpoints that return full client representations rather than filtered metadata.
Monitoring Recommendations
- Enable Keycloak's admin event logging with includeRepresentation=true disabled in production, and forward events to a centralized SIEM.
- Baseline normal usage of the Dynamic Client Registration API and alert on deviations, particularly from accounts without client management privileges.
- Track issuance of access tokens through the client_credentials grant and flag tokens issued shortly after a view-clients read of the same client.
How to Mitigate CVE-2026-89298
Immediate Actions Required
- Review all realm role assignments and remove the view-clients role from accounts that do not require it.
- Rotate client secrets for any client whose details may have been retrieved by non-privileged administrators.
- Restrict access to the Dynamic Client Registration endpoint at the network or reverse-proxy layer where feasible.
Patch Information
Refer to the Red Hat CVE-2026-89298 Advisory for the list of fixed Keycloak and Red Hat build of Keycloak versions. Apply vendor-supplied patches as soon as they are available in your environment, and re-issue client credentials for any client that existed prior to patching.
Workarounds
- Remove or minimize the view-clients role assignment until a fixed version is deployed.
- Prefer confidential client authentication methods that do not rely on shared secrets, such as private_key_jwt with signed JWT assertions.
- Enforce network-level access controls on Keycloak administrative and registration endpoints so that only trusted management hosts can reach them.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
