CVE-2026-17048

4.9 mediumEPSS 0.4%

Medium (4.9) in redhat build of keycloak. EPSS 0.4% chance of exploitation in the next 30 days.

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2026-07-24
Modified: 2026-08-19
Record from: the NVD, synced 2026-10-19

Affected

redhat:build_of_keycloak

References

https://access.redhat.com/errata/RHSA-2026:56523
https://access.redhat.com/errata/RHSA-2026:56524
https://access.redhat.com/security/cve/CVE-2026-17048
https://bugzilla.redhat.com/show_bug.cgi?id=2506743

Check your stack JSON