Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-117688 Diğer

Kayıt geçmişi

1. 29 Eki 2026 09:22Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restart
• 4,2 CVE-2026-118030Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
• 5,4 CVE-2026-117627Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
• 7,4 CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
• 6,5 CVE-2026-19610Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
• 4,2 CVE-2026-114438Keycloak'ta gerekli OTP kaydı, Update User Locale eylem sıralaması nedeniyle atlanabiliyor