Patch Ticker

Keycloak Admin CLI (kcadm) accepts rogue self-signed certificates

An admin tool can be fooled by a fake server and lose admin passwords.

Summary

The Keycloak command-line admin tool kcadm accepts any self-signed certificate when a custom truststore is used, as long as the hostname matches. A network attacker can impersonate the Keycloak server and steal administrator credentials. Red Hat build of Keycloak and Red Hat Single Sign-On 7 are affected.

Affected when

  • kcadm used with a custom truststore to verify the server

What to do

Update Red Hat build of Keycloak 26.4 to 26.4.17 and 26.6 to 26.6.8. Red Hat Single Sign-On 7 has no fixed version named in the sources; read the Red Hat advisory.

Update to at least the version for your product:

  • Red Hat build of Keycloak 26.4 26.4.17 or later
  • Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

  • Linux
  • Red Hat AMQ Broker 7
  • Red Hat build of Keycloak 26.4
  • Red Hat build of Keycloak 26.4.17
  • Red Hat build of Keycloak 26.6
  • Red Hat build of Keycloak 26.6.8
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7

CVE IDs

Sources

Times

First published

First seen