Bug 2539294 (CVE-2026-96453)

Summary: CVE-2026-96453 org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, csuconic, dbruscin, dlofthou, drichtar, ehelms, gmalinko, gtully, istudens, ivassile, iweiss, janstey, jpasqual, jsherman, juwatts, kvanderr, lblicha, mhulan, mosmerov, mposolda, msvehla, nwallace, ogajduse, osousa, pberan, pdelbell, pesilva, pjindal, pmackay, rchan, rgemmell, rgodfrey, rmartinc, rstancel, rstepani, security-response-team, smallamp, ssilvert, sthorger, tbish, thjenkin, tlavocat, vdosoudi, vmuzikar, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-22   

Description OSIDB Bzimport 2026-09-23 09:50:26 UTC 
A certificate validation flaw was found in the Keycloak Admin CLI kcadm within the org.keycloak.client.cli.util package. When an administrator uses the truststore option to specify a custom CA, the underlying HTTP client incorrectly enables TrustSelfSignedStrategy. This configuration causes the client to trust any self-signed certificate presented by the server, provided the hostname matches, effectively bypassing the intended trust material.
An attacker who can perform a Man-in-the-Middle MitM attack or redirect DNS can present a self-signed certificate for the Keycloak hostname. Successful exploitation allows the attacker to intercept administrative traffic, capture sensitive bearer tokens or credentials, and inject forged responses to execute privileged administrative commands on the Keycloak server.