{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/keycloak-admin-cli-kcadm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-96453"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Keycloak Admin CLI (kcadm)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Keycloak"],"content_html":"\u003cp\u003eA vulnerability exists in the Keycloak Admin CLI (kcadm) tool, identified as CVE-2026-96453. The flaw occurs when a custom truststore is provided for server identity verification. In this scenario, the tool incorrectly accepts any self-signed certificate provided the hostname matches the expected value. An attacker with a network-level vantage point can perform a man-in-the-middle (MITM) attack to impersonate the Keycloak server, resulting in the theft of administrative credentials and unauthorized management of the Keycloak instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the interception of administrative authentication traffic, leading to the compromise of credentials and the potential for unauthorized management of the Keycloak server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory environments utilizing the Keycloak Admin CLI (kcadm) tool for automated or manual administrative tasks.\u003c/li\u003e\n\u003cli\u003eAudit automation scripts to identify those that specify a custom truststore (via the --truststore or equivalent configuration parameters).\u003c/li\u003e\n\u003cli\u003eReview network traffic patterns for administrative CLI activity to detect potential MITM anomalies or spoofed endpoint responses until a vendor-supplied patch is applied.\u003c/li\u003e\n\u003cli\u003eMonitor vendor security advisories for the release of a patched version of Keycloak and the associated CLI tooling.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T20:29:41Z","date_published":"2026-11-05T20:29:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-keycloak-mitm/","summary":"The Keycloak Admin CLI (kcadm) tool fails to properly validate server certificates when a custom truststore is configured, enabling attackers to intercept and compromise administrative credentials via man-in-the-middle attacks.","title":"Keycloak Admin CLI: Man-in-the-Middle credential theft (CVE-2026-96453)","url":"https://feed.craftedsignal.io/briefs/2026-11-keycloak-mitm/"}],"language":"en","title":"CraftedSignal Threat Feed - Keycloak Admin CLI (Kcadm)","version":"https://jsonfeed.org/version/1.1"}