CVE-2026-16104

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Improper Removal of Sensitive Information Before Storage or Transfer pada redhat build of keycloak. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-16104 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2501737 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:68277
• https://access.redhat.com/errata/RHSA-2026:68278