Keycloak Admin CLI: Man-in-the-Middle credential theft (CVE-2026-96453)

A vulnerability exists in the Keycloak Admin CLI (kcadm) tool, identified as CVE-2026-96453. The flaw occurs when a custom truststore is provided for server identity verification. In this scenario, the tool incorrectly accepts any self-signed certificate provided the hostname matches the expected value. An attacker with a network-level vantage point can perform a man-in-the-middle (MITM) attack to impersonate the Keycloak server, resulting in the theft of administrative credentials and unauthorized management of the Keycloak instance.

Impact

Successful exploitation allows for the interception of administrative authentication traffic, leading to the compromise of credentials and the potential for unauthorized management of the Keycloak server.

Recommendation

• Inventory environments utilizing the Keycloak Admin CLI (kcadm) tool for automated or manual administrative tasks.
• Audit automation scripts to identify those that specify a custom truststore (via the --truststore or equivalent configuration parameters).
• Review network traffic patterns for administrative CLI activity to detect potential MITM anomalies or spoofed endpoint responses until a vendor-supplied patch is applied.
• Monitor vendor security advisories for the release of a patched version of Keycloak and the associated CLI tooling.