{"id":"CVE-2026-96453","kind":"vulnerability","aliases":["CVE-2026-96453"],"related":[],"title":"Keycloak kcadm: custom truststore accepts any self-signed certificate","description":"A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.","summary":"The Keycloak Admin CLI (kcadm) accepts any self-signed certificate when a custom truststore is supplied, as long as the hostname matches. A network attacker can impersonate the Keycloak server, capture administrator credentials, and perform unauthorized management actions.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kcadm","keycloak","other","red-hat-build-of-keycloak","self-hosted"],"not_affected_if":["default-truststore","no-kcadm-use"],"how_to_check":"Check whether any admin, script or CI job runs 'kcadm.sh config truststore' or passes --truststore to kcadm (look in ~/.keycloak/kcadm.config for a truststore entry). Affected version ranges are not published yet; check Red Hat Bugzilla 2539294 and the Keycloak release notes.","fix":null,"status":"open","published_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:28+00:00","updated_at":"2026-11-05T18:41:21+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T18:40:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak kcadm: custom truststore accepts any self-signed certificate","impact":"high","summary":"The Keycloak Admin CLI (kcadm) accepts any self-signed certificate when a custom truststore is supplied, as long as the hostname matches. A network attacker can impersonate the Keycloak server, capture administrator credentials, and perform unauthorized management actions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["keycloak","kcadm","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"admin credentials stolen via server impersonation, unauthorized management actions","analyst_note":"Find the affected and fixed Keycloak versions and the NVD/Keycloak advisory for CVE-2026-96453; the sources give no version ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["default-truststore","no-kcadm-use"],"who_is_affected":"Teams that run kcadm against a Keycloak server using a custom truststore are exposed, because the tool trusts any self-signed certificate with a matching hostname. Administrators who only use the web console or do not use kcadm with a custom truststore are not affected by this description. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4268,"output_tokens":502,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak versions and the NVD/Keycloak advisory for CVE-2026-96453; the sources give no version ranges.","search":"'-2026':12A,15A '-96453':13A,16A 'accept':5A,34B,106C 'action':67B,135C 'admin':31B,75C 'administr':61B,83C,129C 'allow':119C 'attack':54B,122C 'build':23B 'captur':60B 'certif':10A,39B,111C 'cli':32B,76C 'command':90C 'credenti':62B,130C 'custom':3A,42B,94C 'cve':11A,14A 'flaw':69C 'found':71C 'hat':22B 'host':28B 'hostnam':50B,116C 'ident':102C 'imperson':56B,124C 'incorrect':105C 'kcadm':2A,17B,33B,77C 'keycloak':1A,18B,25B,30B,58B,74C,86C,126C 'line':91C 'long':47B,113C 'manag':66B,85C,134C 'match':51B,117C 'network':53B,121C 'perform':64B,132C 'provid':97C 'red':21B 'red-hat-build-of-keycloak':20B 'self':8A,27B,37B,109C 'self-host':26B 'self-sign':7A,36B,108C 'server':59B,87C,101C,127C 'sign':9A,38B,110C 'steal':128C 'suppli':45B 'tool':78C,104C 'truststor':4A,43B,95C 'unauthor':65B,133C 'use':81C 'verifi':99C","nicknames":[],"mitigations":[],"who_affected":"Teams that run kcadm (Keycloak Admin CLI) against a Keycloak server after configuring a custom truststore (kcadm config truststore) are exposed: the client accepts any self-signed certificate whose hostname matches. An attacker must be able to intercept network traffic between the admin and the server, and the admin must be using a custom truststore. Red Hat lists keycloak-admin-cli, RHBK (rhbk/keycloak-rhel9 and its operator) and rh-sso7-keycloak as affected, with no versions given. Admins who use only the web console, or kcadm with the default Java truststore, can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-11-05T18:41:21Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-96453","run_id":1815}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kcadm","keycloak","other","redhatbuildofkeycloak","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96453","severity":null,"published_at":"2026-11-05T18:17:11+00:00","modified_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96453:1815","url":"https://access.redhat.com/security/cve/CVE-2026-96453","severity":null,"published_at":"2026-11-05T18:41:21+00:00","modified_at":"2026-11-05T18:41:21+00:00","first_seen_at":"2026-11-05T18:41:21+00:00","fetched_at":"2026-11-05T18:41:21+00:00","note":"Red Hat CVE page (CNA) read: root cause is the Admin CLI HTTP client trust strategy accepting self-signed certs when a truststore is given; reporter Paul Bottinelli (Trail of Bits with OpenAI). Page gives NO affected/fixed versions and says no mitigation is available; Bugzilla 2539294. Upstream Keycloak advisory not found. Fix unknown; not claiming 'none' since page does not say no fix.","cites":["https://access.redhat.com/security/cve/CVE-2026-96453"]}],"documents":[{"id":78779,"url":"https://access.redhat.com/security/cve/CVE-2026-96453","title":"Red Hat CVE-2026-96453","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}