Is CVE-2026-16104 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16104 being exploited in the wild.

How severe is CVE-2026-16104?

Medium severity, with a CVSS score of 4.3, published 17 July 2026.

Which products and versions are affected?

Red Hat build of Keycloak unspecified.

Is there a fix for CVE-2026-16104?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16104 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-16104?

Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16104: Red Hat Build of Keycloak Information Exposure in Authentication Config

CVE-2026-16104 · Severity: medium · CVSS 4.3 · Published 2026-07-17

A security flaw in Red Hat Build of Keycloak allows administrative users with limited 'view-only' permissions to see sensitive third-party credentials, such as reCAPTCHA secret keys. These secrets are also recorded in plain text within administrative logs. An attacker with access to these logs or a low-level administrative account could use this information to bypass security measures like bot detection.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-16104 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16104 being exploited in the wild.
How severe is CVE-2026-16104?: Medium severity, with a CVSS score of 4.3, published 17 July 2026.
Which products and versions are affected?: Red Hat build of Keycloak unspecified.
Is there a fix for CVE-2026-16104?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16104 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-16104?: Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information exposure vulnerability exists in the 'keycloak-services' component of Red Hat Build of Keycloak. The flaw is located in the 'ModelToRepresentation.toRepresentation' method, which fails to filter or mask configuration entries marked as secrets in provider metadata when processing requests to the 'GET /admin/realms/{realm}/authentication/config/{id}' endpoint. This allows authenticated users with the 'view-realm' role to retrieve raw secret values, such as reCAPTCHA secret keys. Furthermore, these unmasked secrets are serialized into administrative events, potentially exposing them to any user with log-reading privileges. This exposure can be leveraged to undermine bot-detection mechanisms.

Affected products

Red Hat Red Hat Build of Keycloak unspecified

Timeline

2026-07-17: disclosed: Initial vulnerability report and CVE publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.