{"id":"CVE-2026-117688","kind":"vulnerability","aliases":["CVE-2026-117688"],"related":[],"title":"Keycloak: client owner can read vault secrets through client registration","description":"A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.","summary":"Keycloak's client registration component lets an authenticated client owner point a client secret at a vault entry they should not reach. Requesting the client configuration then returns that secret in plain text.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","runtime","self-hosted"],"not_affected_if":["admin-only-clients","no-vault-provider"],"how_to_check":"- Check whether vault providers are configured for Keycloak secrets (unknown from the sources whether a specific setting enables this)\n- Check the Keycloak version in use with `kc.sh --version` (unknown which versions are affected)","fix":null,"status":"open","published_at":"2026-10-29T07:16:44+00:00","first_seen_at":"2026-10-29T07:23:29+00:00","triaged_at":"2026-10-29T07:23:47+00:00","updated_at":"2026-10-29T07:23:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-29T07:23:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: client owner can read vault secrets through client registration","impact":"medium","summary":"Keycloak's client registration component lets an authenticated client owner point a client secret at a vault entry they should not reach. Requesting the client configuration then returns that secret in plain text.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"client owner reads stored secrets in plain text","analyst_note":"Find the affected and fixed Keycloak version ranges and the vendor advisory for CVE-2026-117688 at the NVD link.","how_to_check":"- Check whether vault providers are configured for Keycloak secrets (unknown from the sources whether a specific setting enables this)\n- Check the Keycloak version in use with `kc.sh --version` (unknown which versions are affected)","plain_action":"","needs_analyst":true,"not_affected_if":["no-vault-provider","admin-only-clients"],"who_is_affected":"Teams running Keycloak as their identity provider that use a vault provider to store client secrets, where some users can register or own clients. The sources do not name affected version ranges, so the exact exposure is unknown. Deployments without a vault provider, or where clients are managed only by administrators, are likely not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000678,"input_tokens":4162,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117688':13A,16A '-2026':12A,15A 'abl':145C 'access':73C,147C 'authent':30B,87C 'client':2A,9A,25B,31B,35B,47B,62C,88C,106C,118C 'compon':27B,64C 'configur':48B,119C 'could':131C 'craft':94C 'credenti':138C 'cve':11A,14A 'entri':40B,113C 'exposur':135C 'flaw':57C 'found':59C 'host':22B 'ident':17B,71C 'inform':85C 'keycloak':1A,18B,23B,66C 'lead':132C 'let':28B 'manag':74C 'open':69C 'open-sourc':68C 'owner':3A,32B,89C,121C 'plain':54B,128C 'point':33B,109C 'provid':79C 'reach':44B 'read':5A 'refer':95C 'registr':10A,26B,63C 'request':45B,116C 'return':50B 'reveal':101C 'runtim':19B 'secret':7A,36B,52B,102C,107C,125C 'see':123C 'self':21B 'self-host':20B 'sensit':84C,137C 'solut':75C 'sourc':70C 'special':93C 'store':83C 'system':99C 'text':55B,129C 'trick':97C 'updat':104C 'use':81C,91C 'user':141C 'valu':126C 'vault':6A,39B,78C,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running Keycloak as their identity provider that use a vault provider to store client secrets, where some users can register or own clients. The sources do not name affected version ranges, so the exact exposure is unknown. Deployments without a vault provider, or where clients are managed only by administrators, are likely not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T07:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117688","severity":null,"published_at":"2026-10-29T07:16:44+00:00","modified_at":"2026-10-29T07:16:44+00:00","first_seen_at":"2026-10-29T07:23:29+00:00","fetched_at":"2026-10-29T07:23:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}