Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123059— Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

Quick assessment

Affected
Eclipse Foundation Eclipse BaSyx Helm Charts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Eclipse BaSyx Helm Charts 版本 2.2.0 的 图表中，若启用了捆绑的 Keycloak，部署会将 OAuth2 客户端 的客户端密钥以明文形式存储在 Kubernetes ConfigMap 中。该客户端使用客户端凭证授权（client-credentials grant）模式，且其服务账户拥有 realm 级别的 角色。 虽然该图表已正确将 写入 Kubernetes Secret，但模板文件 却将同一值代入到 Keycloak 的 realm 导入 JSON 中，而该 JSON

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123059

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role. The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `<keycloak.fullnameOverride>-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment. The bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse BaSyx Helm Charts 2.2.0 -

II. Public POCs for CVE-2026-123059

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123059

请登录查看更多情报信息。

Other References for CVE-2026-123059 (4)

IV. Related Vulnerabilities

Same product: Eclipse BaSyx Helm Charts
Same vendor: Eclipse Foundation
Same weakness: CWE-312