CVE-2026-16104: redhat build_of_keycloak
Vulnerability summary
CVE-2026-16104 is a medium (CVSS 6.5) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38% of scored vulnerabilities.
Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.20 pp
From 0.26% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Redhat1 product
1 vendor · 1 product