Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
Affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, among other Red Hat products, when kcadm uses the truststore option for a custom CA. No fixed version is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. A custom truststore is provided to verify the server identity. The administrator uses the kcadm truststore option to specify a custom CA.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 35/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Keycloak Admin CLI (kcadm), the command-line tool administrators use to manage Keycloak servers, can be tricked into trusting any self-signed certificate when a custom truststore is supplied, as long as the hostname matches. A network attacker can reach this remotely without logging in, but the victim must take an action to trigger it, and the attacker could then impersonate the Keycloak server, steal administrative credentials, and carry out unauthorized management actions.
Read the original description
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach10/20Shipped in major Linux distributions
- Severity8/10CVSS 8.0
- No patch5/5No patch listed yet
What would change the score
- Would score about 85 if added to CISA KEV
- Would score about 80 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
A custom truststore is provided to verify the server identity. The administrator uses the kcadm truststore option to specify a custom CA.Workaround: The checked facts list no workaround. The issue only arises when the kcadm truststore option is used to specify a custom CA, so avoiding that option is the only limit the facts support.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- keycloak-core
Version range not reported
- keycloak-admin-cli
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- rhbk/keycloak-rhel9-operator
Version range not reported
- keycloak-core
Version range not reported
- jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
Version range not reported
- jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Version range not reported
- jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Version range not reported
Show all 14 packagesShow fewer packages
- keycloak-core
Version range not reported
- keycloak-core
Version range not reported
- candlepin
Version range not reported
- keycloak-admin-cli
Version range not reported
- keycloak-core
Version range not reported
- rh-sso7-keycloak
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-96453
Is CVE-2026-96453 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When kcadm is given a custom truststore to verify the server's identity, it can accept arbitrary self-signed certificates. The advisory says this could let an attacker capture administrative credentials and perform unauthorized administrative actions on the Keycloak server.Source: access.redhat.com, bugzilla.redhat.com
Am I affected, and how do I check?
The listed products include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, AMQ Broker 7, Fuse 7, JBoss EAP 7 and 8, and Satellite 6, but the checked facts give no version ranges. The issue only arises when the kcadm truststore option is used to specify a custom CA, so a reader can check whether their scripts or commands use that option and which product version they run.Source: access.redhat.com, bugzilla.redhat.com
How do I fix CVE-2026-96453?
The checked facts name no fixed version, so check the vendor advisory for updated builds of the affected products. Until a fix is confirmed, review how kcadm is used in your environment.Source: access.redhat.com, bugzilla.redhat.com
What if there's no patch?
The checked facts list no workaround. The issue only arises when the kcadm truststore option is used to specify a custom CA, so avoiding that option is the only limit the facts support.Source: access.redhat.com, bugzilla.redhat.com