Red Hat Keycloak CVE-2026-16108

Exploitation requires an authenticated account with delegated administrator privileges that include realm-viewing permissions (view-realm role or equivalent) within the target Keycloak realm. The deploying organization must have configured one or more groups as hidden default groups - if no groups are hidden, no sensitive metadata is exposed. The vulnerable surface is the admin REST API's default-groups endpoint and realm representation, meaning the attacker needs network access to the Keycloak admin API (typically port 8080 or 8443), which is often restricted to internal networks. Exploitation is bounded by the following limiting factors: standard end-user accounts and unauthenticated principals cannot trigger this; only group names and identifiers are disclosed, not membership lists, credentials, or tokens; and impact is absent in deployments where group names do not encode sensitive information.

The CVSS 4.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, real but non-critical issue. The network attack vector with no complexity requirement means any delegated admin can exploit this without special tooling, but the PR:L requirement - a low-privilege authenticated account with realm-view rights - is a meaningful gating condition that rules out unauthenticated exploitation. No KEV listing and no known POC further reduce urgency. EPSS data is not provided in the input, so exploitation probability cannot be quantified. The practical organizational risk depends heavily on deployment context: if hidden groups encode sensitive organizational hierarchies, regulatory groupings, or security-tier memberships, this disclosure provides useful reconnaissance to an insider threat or a compromised delegated admin account. In deployments where hidden group names are arbitrary or opaque, risk is negligible. This is not a 'patch immediately' emergency but warrants timely remediation in environments where group naming encodes sensitive information.

A help desk operator or tenant administrator holding a delegated admin role with realm-view permissions - but intentionally denied group-view rights by a security policy - authenticates to the Keycloak admin REST API and issues a GET request to the default-groups endpoint or retrieves the realm representation object. The API response includes names and internal UUIDs of groups that were configured as hidden, revealing organizational group topology such as department names, security tiers, or regulatory classifications. The attacker uses this structural knowledge to identify high-value groups for subsequent privilege escalation or social engineering attempts.