[CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets - #51209
[CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets#51209mabartos wants to merge 1 commit into
Conversation
mabartos
commented
Jul 27, 2026
- Closes [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets #51145
… Client Secrets Closes keycloak#51145 Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.cluster.UserFederationInvalidationClusterTest#crudWithoutFailoverorg.keycloak.testsuite.cluster.UserFederationInvalidationClusterTest#crudWithFailover |
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Addresses CVE-2026-17048 by preventing vault resolution of rotated client secrets when returned via the Keycloak Admin REST API, avoiding leakage of vault-backed secret values.
Changes:
- Add an API path that returns rotated secrets without vault resolution, and an internal path that can resolve vault expressions for authentication.
- Update rotated-secret validation/authentication flow to explicitly resolve vault expressions.
- Add an integration test and test vault secret resource to verify Admin API does not return resolved values.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| tests/base/src/test/resources/org/keycloak/tests/admin/vault/default_rotated__secret | Adds a vault-backed rotated secret test resource. |
| tests/base/src/test/java/org/keycloak/tests/admin/ClientVaultTest.java | Adds coverage ensuring the Admin API returns the raw rotated-secret placeholder, and enables secret-rotation feature for the test server. |
| services/src/main/java/org/keycloak/protocol/oidc/OIDCClientSecretConfigWrapper.java | Splits rotated-secret retrieval into “no vault resolution” vs “resolve for auth” paths and updates validation/auth usage accordingly. |
| assertEquals(vaultExpression, rotatedSecret); | ||
| } | ||
|
|
||
| @Test |
There was a problem hiding this comment.
Just a recommendation :
testRotatedSecretEndpointDoesNotResolveVault() you test for the Admin API returning the raw placeholder, but do not test for Authentication with a vault-backed rotated secret that actually succeeds
Useful for regression.
`@Test
void testAuthenticationWithVaultBackedRotatedSecret() {
// "rotatedsecret" is the value stored in the vault file default_rotated__secret
AccessTokenResponse response = oauthClient
.client("myclient-with-rotated-vault-secret", "rotatedsecret")
.doPasswordGrantRequest("test-user@localhost", "password");
assertEquals(200, response.getStatusCode());
assertNotNull(response.getAccessToken());
}`
msdaly200
left a comment
There was a problem hiding this comment.
Just one nit to add a regression test, but everything looks good to fix the vulnerability.