---
id: "CVE-2026-117688"
kind: "vulnerability"
aliases: ["CVE-2026-117688"]
title: "Keycloak: client owner can read vault secrets through client registration"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["identity", "keycloak", "runtime", "self-hosted"]
not_affected_if: ["admin-only-clients", "no-vault-provider"]
published_at: "2026-10-29T07:16:44+00:00"
first_seen_at: "2026-10-29T07:23:29+00:00"
updated_at: "2026-10-29T07:23:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117688", "first_seen_at": "2026-10-29T07:23:29+00:00"}]
---

# Keycloak: client owner can read vault secrets through client registration

Keycloak's client registration component lets an authenticated client owner point a client secret at a vault entry they should not reach. Requesting the client configuration then returns that secret in plain text.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether vault providers are configured for Keycloak secrets (unknown from the sources whether a specific setting enables this)
- Check the Keycloak version in use with `kc.sh --version` (unknown which versions are affected)

## Timeline

- 2026-10-29T07:23:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117688

## From the sources

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_