Live › vulnerability › CVE-2026-117688
Keycloak's client registration component lets an authenticated client owner point a client secret at a vault entry they should not reach. Requesting the client configuration then returns that secret in plain text.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 07:23 UTC. All times on this page are UTC.
Teams running Keycloak as their identity provider that use a vault provider to store client secrets, where some users can register or own clients. The sources do not name affected version ranges, so the exact exposure is unknown. Deployments without a vault provider, or where clients are managed only by administrators, are likely not exposed.
No product ranges from the sources yet.
kc.sh --version (unknown which versions are affected)No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
This page as .md · .json · in your agent: get_signal("CVE-2026-117688")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.