CVE-2026-107604

Executive Summary

CVE-2026-107604 is an information disclosure vulnerability in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator holding only the read-only view-clients role can retrieve the active primary secret of any confidential client — a value that should be restricted to higher-privileged administrative roles. Possession of the exposed client secret allows an attacker to impersonate the confidential client and inherit its associated service account permissions, enabling unauthorized access to downstream systems that trust that client's tokens.

Technical Analysis

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw resides in two related surfaces: the installation provider and the client registration endpoints. Per the NVD description, these endpoints fail to enforce an adequate authorization boundary when responding to requests from a realm administrator whose only granted role is view-clients — a role explicitly intended to be read-only with respect to client configuration.

The core mechanism is a broken access control condition layered on top of an authorization model misconfiguration. In Keycloak's administrative hierarchy, client configuration and client credentials are logically distinct objects with different sensitivity levels. A read-only viewer of client metadata should not be able to observe the active primary secret of a confidential client, because that secret is a bearer-equivalent authenticator: anyone holding it can authenticate as the client to the token endpoint. The affected endpoints apparently return the secret within their response payload regardless of whether the caller possesses the capability normally gated to a client-management role with write or credential-view authority.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates the attack is network-reachable with low complexity, but requires high privileges (the attacker must already hold an administrative role — here, one granted view-clients) and no user interaction. Only confidentiality is impacted, at High severity; integrity and availability are unaffected, and the scope remains unchanged. The resulting base score of 4.9 reflects that the vulnerability is not remotely exploitable by an anonymous actor — it is a privilege-boundary / role-separation failure inside the administrative plane, not a pre-authentication flaw.

Because the description provides no version range, no fixed release, and no additional endpoint parameter names, the assessment must remain at the behavior class level: an authorization check is missing or too permissive on response serialization for confidential client secrets, exposed to a role that should not receive them.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-107604; the attack chain below is inferred from the vulnerability class (CWE-200 via broken access control) and the NVD description. No specific function names, URL paths, or parameter names beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker requires an existing, authenticated realm-administrator account that has been granted the view-clients role — the lowest client-visibility role in the target realm. This role is typically assigned to operators, support staff, or auditors who are meant to review client configuration without touching credentials. The attacker identifies a target Keycloak deployment (self-hosted or managed) and confirms they can reach the administrative interface.

2. Trigger of the flaw class. Using the read-only administrative session, the attacker issues requests against the installation provider and client registration endpoints. Because those endpoints do not enforce a credential-viewing capability check, the response for a confidential client includes the active primary secret. The attacker enumerates confidential clients in the realm and harvests the returned secrets. This is an authorization bypass by omission: the caller is legitimately authenticated, but the endpoint grants access to data beyond the caller's granted role.

3. Payload / execution method (vulnerability-class level). No crafted payload, injection string, or exploit code is required. The "payload" is simply an authorized HTTP request to the affected administrative endpoint, sent with the low-privileged administrative token. The vulnerability is triggered by the normal request flow returning data it should not return.

4. Post-exploitation impact. Armed with a valid confidential-client secret, the attacker authenticates as that client. Per the NVD description, this allows impersonation of the client and use of its associated service account permissions. The attacker can mint or obtain tokens carrying the client's service-account roles and then use them against any resource server or downstream API that trusts the Keycloak realm as its identity provider — escalating from a read-only administrative role to whatever privileges the impersonated client's service account holds. This is a lateral authorization escalation rather than a memory-corruption or code-execution outcome.

Impact Assessment

The blast radius is defined by the privileges granted to the impersonated confidential clients' service accounts. In enterprise deployments, service accounts frequently hold broad API access across microservices, CI/CD pipelines, and internal platforms, so a single harvested secret can translate into wide lateral movement even though the initial foothold is "only" a low-privileged admin.

CVSS subscores: Confidentiality is High — the active primary client secret is directly disclosed. Integrity and Availability are None — the vulnerability itself does not modify or disrupt data, though downstream abuse of the client's permissions could cause integrity effects beyond the scope of this CVE's scoring. The PR:H metric reflects that the attacker must already hold a realm-administrator account with the view-clients role; this bounds the population of viable attackers to insiders, delegated administrators, and anyone who has compromised such an account. The 4.9 base score is moderate, but the real-world consequence can be severe because leaked client secrets are directly usable authentication material.

Affected systems are Keycloak identity management deployments (self-hosted or vendor-managed) in which confidential clients exist and less-privileged administrative roles are delegated. Multi-tenant Keycloak installations where one realm's administrator reviews client settings are at particular risk of cross-service credential exposure.

Detection Guidance

Sigma Rule

title: Potential Keycloak Confidential Client Secret Disclosure via Read-Only Admin Role
id: 5c1f9e2a-7b3d-4a61-9f0e-2d8c14a6b7e3
status: experimental
description: Detects administrative access to Keycloak installation provider / client registration endpoints that may disclose confidential client secrets to a low-privileged view-clients role.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107604
author: valtersit.com
date: 2026/01/01
logsource:
  product: keycloak
  service: admin-events
detection:
  selection_endpoint:
    request_path|contains:
      - '/clients-registrations'
      - '/installation/providers'
  selection_admin:
    user_realm_roles|contains: 'view-clients'
  condition: selection_endpoint and selection_admin
falsepositives:
  - Legitimate client-registration automation performed by properly privileged service accounts
level: medium

YARA Rule

rule CVE_2026_107604_Keycloak_Client_Secret_Disclosure
{
    meta:
        description = "Detects HTTP response/log artifacts containing confidential client secret disclosure indicators from Keycloak client registration or installation provider endpoints"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107604"
        date = "2026-01-01"

    strings:
        $ep1 = "/clients-registrations" ascii nocase
        $ep2 = "/installation/providers" ascii nocase
        $secret = "secret" ascii nocase
        $clientid = "clientId" ascii nocase
        $regtoken = "registrationAccessToken" ascii nocase

    condition:
        ($ep1 or $ep2) and $secret and ($clientid or $regtoken)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107604 Possible Keycloak Confidential Client Secret Disclosure via client registration/installation endpoint"; flow:established,to_server; http.uri; content:"/clients-registrations"; nocase; http.uri; content:"/installation/providers"; nocase; classtype:attempted-recon; reference:cve,2026-107604; sid:2026107604; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [http where http.request.method == "GET" and url.path : ("/clients-registrations*" or "/installation/providers*")]
  [http where http.response.status_code == 200 and
     (http.response.body : "*secret*" or http.response.body : "*registrationAccessToken*")]

Splunk SPL Query

index=keycloak sourcetype=keycloak:admin_events
| search (uri_path="/clients-registrations*" OR uri_path="/installation/providers*")
| where match(roles, "(?i)view-clients")
| stats count values(uri_path) as accessed_paths values(client_id) as clients by user, src_ip
| where count > 0

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-107604,">
  <rule id="107604" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/clients-registrations|/installation/providers</field>
    <field name="roles">view-clients</field>
    <description>CVE-2026-107604: Possible Keycloak confidential client secret disclosure via read-only admin role accessing client registration/installation endpoint.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The following measures are mitigations only and must be validated against the specific Keycloak version in use.

1. Immediate mitigations.

   • Remove the view-clients role from any realm administrator who does not strictly require it; audit role assignments for least privilege.
   • Reduce reliance on confidential clients where public clients with PKCE are viable, limiting the population of exposable secrets.
   • If the deployment permits, restrict or disable access to the installation provider and client registration endpoints at the reverse proxy / network layer for non-privileged administrative identities.
   • Monitor administrative audit logs for access to client credential data by low-privileged roles (see Detection Guidance).

2. Patch/upgrade steps.

   • No vendor patch is currently identified in the tracked sources. Monitor the official Keycloak release channels and advisories for a fixed version, then upgrade as soon as it is published.
   • Until a fix is available, treat all client secrets in affected realms as potentially disclosed and rotate them, especially for confidential clients whose service accounts hold elevated permissions.

3. Long-term hardening.

   • Enforce strict role separation so that client metadata visibility (view-clients) is decoupled from client credential access.
   • Rotate confidential client secrets on a defined schedule and after any suspected exposure to limit the window of abuse.
   • Apply least-privilege scoping to all service accounts so that a single leaked client secret cannot grant broad access.

References

• NVD — CVE-2026-107604: https://nvd.nist.gov/vuln/detail/CVE-2026-107604
• FIRST.org EPSS: https://www.first.org/epss/ (CVE not yet scored as of this report)
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Keycloak project security advisories (monitor for fixed release): https://www.keycloak.org/security

No threat actor campaign, in-the-wild exploitation, public PoC, Nuclei template, or CISA KEV listing has been observed for CVE-2026-107604 as of this report.