Security Flaw in Keycloak Admin CLI Tool Affects Keycloak Servers
CVE-2026-96453

8HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat AMQ Broker 7
Red Hat Build Of Keycloak
Red Hat Fuse 7
Red Hat Jboss Enterprise Application Platform 7
Vendor
CVE Published:
5 November 2026

What is CVE-2026-96453?

A security flaw exists in the Keycloak Admin CLI kcadm tool, commonly utilized by administrators for server management from the command line. This vulnerability arises when a custom truststore is set, leading the tool to erroneously accept any self-signed certificate that matches the hostname. Consequently, this oversight enables a network attacker to impersonate the Keycloak server, potentially gaining access to administrative credentials and executing unauthorized management actions.

References

https://access.redhat.com/security/cve/CVE-2026-96453
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2539294
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Paul Bottinelli (Trail of Bits in collaboration with OpenAI) for reporting this issue.
.