CVE-2026-96453 · Other
NO FIX YET
The Keycloak Admin CLI (kcadm) accepts any self-signed certificate when a custom truststore is supplied, as long as the hostname matches. A network attacker can impersonate the Keycloak server, capture administrator credentials, and perform unauthorized management actions.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run kcadm (Keycloak Admin CLI) against a Keycloak server after configuring a custom truststore (kcadm config truststore) are exposed: the client accepts any self-signed certificate whose hostname matches. An attacker must be able to intercept network traffic between the admin and the server, and the admin must be using a custom truststore. Red Hat lists keycloak-admin-cli, RHBK (rhbk/keycloak-rhel9 and its operator) and rh-sso7-keycloak as affected, with no versions given. Admins who use only the web console, or kcadm with the default Java truststore, can skip it.
Not affected if default-truststore, no-kcadm-use
Who cares kcadm, keycloak, red-hat-build-of-keycloak, self-hosted
kcadm.sh config truststore or passes --truststore to kcadm (look in ~/.keycloak/kcadm.config for a truststore entry)No fix yet, per the sources.
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.