CVE-2026-107604 Information disclosure in Red Hat Build of Keycloak
Realm administrators with view-clients role can retrieve active client secrets, enabling client impersonation and unauthorized service account access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107604?
CVE-2026-107604 is a medium-severity vulnerability in Red Hat Build of Keycloak, published on 8 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.
Weakness: CWE-200
Which versions are affected by CVE-2026-107604?
How do I fix CVE-2026-107604?
No fix has been published for CVE-2026-107604 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107604 being exploited?
There is no known exploitation of CVE-2026-107604 in the wild and no public exploit code.
Sources
Also known as GHSA-ch4r-x5r9-rqr3.