Description

A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificate as long as the hostname matches. This allows a network attacker to impersonate the Keycloak server, steal administrative credentials, and perform unauthorized management actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-11-05T18:17:11.270Z",
  "pubdate": "2026-11-05T18:17:11.270Z",
  "executiveSummary": "The Keycloak Admin CLI (kcadm) tool suffers from a critical certificate validation flaw that enables man-in-the-middle (MITM) attacks. When a custom truststore is configured, the application improperly validates server certificates by accepting any self-signed certificate, provided the hostname matches the expected server identity.\nThis vulnerability constitutes an improper certificate validation issue, effectively negating the security guarantees provided by TLS. An attacker with the capability to intercept network traffic between the administrator and the Keycloak server can impersonate the legitimate administrative endpoint.\nThe risk implication is severe, as the attacker can transparently proxy administrative communication. This allows for the interception of sensitive administrative credentials, authentication tokens, and the subsequent execution of unauthorized management commands on the Keycloak server.\nSuccessful exploitation requires the attacker to position themselves within the network path (e.g., via DNS spoofing, ARP poisoning, or malicious routing) to redirect traffic intended for the Keycloak server. No specific authentication is required from the attacker to initiate the intercept, as the vulnerability resides in the client-side trust decision-making process of the kcadm tool itself.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of TLS/SSL handshake validation within the kcadm utility when a custom truststore is supplied. Instead of enforcing strict certificate chain validation or verifying that the presented certificate is signed by a trusted Certificate Authority (CA) residing within the specified truststore, the tool logic defaults to a weakened verification state.\nWhen kcadm is invoked with a custom truststore flag, the underlying X.509 certificate verification routine fails to perform exhaustive path validation. Specifically, it erroneously validates the server's identity based solely on a hostname match, regardless of whether the certificate chain can be traced to a root of trust. By accepting self-signed certificates that match the hostname, the implementation ignores the absence of a valid chain of trust.\nThe exploitation flow is as follows: 1) An attacker intercepts the network traffic between the administrator's terminal and the Keycloak server using techniques such as ARP cache poisoning or a compromised local router. 2) The attacker presents a fraudulent, self-signed certificate to the kcadm tool. This certificate is crafted to include the legitimate hostname of the Keycloak server in the Subject Alternative Name (SAN) or Common Name (CN) field. 3) The kcadm tool, upon encountering the custom truststore configuration, performs a validation check. The flawed logic verifies the hostname, observes a match, and deems the connection 'trusted,' despite the certificate being self-signed and untrusted by any legitimate PKI. 4) The encrypted TLS tunnel is established between the administrator and the attacker’s machine, while the attacker simultaneously maintains a separate connection to the actual Keycloak server. 5) The attacker captures administrative credentials transmitted during the authentication phase or session tokens used for management operations.\nThis vulnerability affects the kcadm command-line interface tool utilized for remote server management. It is a client-side vulnerability that directly impacts the integrity and confidentiality of administrative sessions. The attack requires no prior knowledge of the target server's existing security configuration, as the exploitation is triggered by the administrator's own connection attempts through the compromised path. Post-exploitation, the attacker possesses the same administrative privileges as the victim, allowing for the creation of unauthorized accounts, modification of security realms, or total server reconfiguration."
}