CVE-2026-117688: Red Hat Build of Keycloak Information Disclosure

Description

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Enumeration

CWE-200

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	All versions

References

Timeline

Published: Oct 29, 2026
Last Modified: Oct 29, 2026
Status: Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-117688?

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.

How severe is CVE-2026-117688?

CVE-2026-117688 has a CVSS score of 5.3/10 (MEDIUM severity).

How do I fix CVE-2026-117688?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →