CVE-2026-17048

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Keycloak Admin REST API used for managing security realms and clients. The issue arises during the processing of requests for rotated client secrets stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, resulting in the exposure of sensitive credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.