CVE-2026-107604: Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints
A flaw was found in the Admin REST installation provider endpoints and the Client Registration install endpoint in Keycloak. While the dedicated client-secret endpoint correctly enforces authorization, these specific endpoints fail to mask the client secret when accessed by a user with the realm-management:view-clients role. An authenticated attacker with this role can retrieve the cleartext secret of any confidential client using the client-secret authenticator. Successful exploitation allows the attacker to obtain a client-credentials access token and exercise the target client's service account permissions. This issue represents an incomplete fix for CVE-2026-89298.
Other sources
A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Keycloak deployments with confidential clients that use the client-secret authenticator are exposed if a user has the realm-management:view-clients role. The issue affects users who should have read-only client visibility but can access installation provider or Client Registration install endpoints.
What does an attacker need to exploit it?
An attacker must already be authenticated and have the realm-management:view-clients role. They can then retrieve the active primary secret for any qualifying confidential client through the affected endpoints.
What can an attacker do with a retrieved secret?
The attacker can use the secret to obtain a client-credentials access token and impersonate the target client. Access is then limited by the permissions assigned to that client's service account.
How can teams assess whether they are at risk?
Review which users or administrative identities hold realm-management:view-clients, and identify confidential clients using the client-secret authenticator. Those identities may be able to retrieve those clients' active primary secrets through the affected installation or client-registration endpoints.