Keycloak Admin CLI (Kcadm) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/keycloak-admin-cli-kcadm/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 20:29:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKeycloak Admin CLI: Man-in-the-Middle credential theft (CVE-2026-96453)https://feed.craftedsignal.io/briefs/2026-11-keycloak-mitm/Thu, 05 Nov 2026 20:29:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-keycloak-mitm/The Keycloak Admin CLI (kcadm) tool fails to properly validate server certificates when a custom truststore is configured, enabling attackers to intercept and compromise administrative credentials via man-in-the-middle attacks.A vulnerability exists in the Keycloak Admin CLI (kcadm) tool, identified as CVE-2026-96453. The flaw occurs when a custom truststore is provided for server identity verification. In this scenario, the tool incorrectly accepts any self-signed certificate provided the hostname matches the expected value. An attacker with a network-level vantage point can perform a man-in-the-middle (MITM) attack to impersonate the Keycloak server, resulting in the theft of administrative credentials and unauthorized management of the Keycloak instance.

Impact

Successful exploitation allows for the interception of administrative authentication traffic, leading to the compromise of credentials and the potential for unauthorized management of the Keycloak server.

Recommendation

  • Inventory environments utilizing the Keycloak Admin CLI (kcadm) tool for automated or manual administrative tasks.
  • Audit automation scripts to identify those that specify a custom truststore (via the --truststore or equivalent configuration parameters).
  • Review network traffic patterns for administrative CLI activity to detect potential MITM anomalies or spoofed endpoint responses until a vendor-supplied patch is applied.
  • Monitor vendor security advisories for the release of a patched version of Keycloak and the associated CLI tooling.
]]>highadvisory