Keycloak CVE-2026-89298

Exploitation requires that the attacker possess a valid Keycloak account that has been explicitly granted the view-clients realm management role - this role is not assigned by default to end users or even to all administrators, and must be deliberately delegated by a realm admin. The target client must be a confidential OAuth/OIDC client (one that uses a client_secret); public clients have no secret to expose. The Keycloak admin REST API or Dynamic Client Registration endpoint must be reachable by the attacker, which is typically restricted to internal networks in hardened deployments. What limits exploitation is the necessity of a specific role assignment: unauthenticated users, regular realm users, and administrators without the view-clients role cannot trigger the exposure.

The CVSS 4.9 medium score is justified at the raw metric level - PR:H requires the attacker to already hold a specific administrative role - but the practical business impact is meaningfully higher than the numeric score suggests because the compromised credential enables secondary privilege escalation: a view-clients user who obtains a client_secret can impersonate any confidential client in the realm, potentially gaining access to protected resource servers, user data, or other admin-adjacent APIs depending on how clients are scoped. No public exploit code and no CISA KEV listing are present in the available data. EPSS data was not provided in the input, so exploitation probability cannot be quantified. The realistic threat actor is a malicious or compromised insider - a junior admin or delegated operator - rather than an external attacker, since obtaining the view-clients role requires prior authorization by a realm administrator; even a mid-sized municipal IT team in gniezno should treat this as urgent if they practice role delegation to reduce admin blast radius, since those delegated roles now carry an undisclosed escalation path.

A realm administrator delegates the view-clients role to a junior support engineer to allow them to troubleshoot OAuth client configurations without granting full admin access. The engineer - or an attacker who compromises their credentials - calls the Dynamic Client Registration endpoint for a high-privilege confidential client (such as one with a service account having manage-realm permissions) and receives the client_secret in the JSON response. The attacker then uses that secret in a client_credentials grant to obtain an access token as that client and exercises the client's full realm permissions.