Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
Only deployments with the bundled Keycloak enabled (keycloak.enabled=true) in basyx chart 3.0.0-rc.1 to 3.12.1 are affected. The issue is fixed in basyx chart 3.12.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.12.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Deployments with the bundled Keycloak enabled (keycloak.enabled=true) in the basyx chart. Affects basyx chart versions 3.0.0-rc.1 to 3.12.1.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Eclipse BaSyx Helm Charts deployments with the bundled Keycloak enabled store Keycloak user passwords in cleartext in a Kubernetes ConfigMap, so an attacker who can reach the deployment over the network with a low-privilege login can read the bootstrap administrator's password and sign in to Keycloak as that admin. The admin role then grants full rights across all BaSyx APIs in the deployment.
Read the original description
In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the basyx chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap.
The template keycloak-init-config.yaml rendered keycloak.initialization.users, including each user's credentials[].value, as users.json into the persistent ConfigMap <release>-basyx-keycloak-init-config. By default this includes the bootstrap administrator user. That user holds the admin role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes view ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the admin role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment.
The bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the basyx chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.5/10CVSS 7.5, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Deployments with the bundled Keycloak enabled (keycloak.enabled=true) in the basyx chart. Affects basyx chart versions 3.0.0-rc.1 to 3.12.1.Upgrade to a fixed version: 3.12.2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Eclipse Foundation Eclipse BaSyx Helm Charts
From 3.0.0-rc.1 · fixed in 3.12.2
Evidence 4
- Advisory
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123047
Is CVE-2026-123047 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The bootstrap administrator's Keycloak password is stored in cleartext in a ConfigMap. Anyone who can read that ConfigMap can obtain the password, log in as that user, and get a token with the admin role, which maps to full rights on all BaSyx APIs in the deployment.Source: cve.org, gitlab.eclipse.org
Which versions are affected by CVE-2026-123047?
Eclipse BaSyx Helm Charts: from 3.0.0-rc.1 before 3.12.2.Source: cve.now feed data
Am I affected, and how do I check?
The bug is in basyx chart versions 3.0.0-rc.1 through 3.12.1, and only in deployments with the bundled Keycloak enabled. To check, look at the basyx chart version in use and whether keycloak.enabled is set to true in the chart values.Source: cve.org, gitlab.eclipse.org
How do I fix CVE-2026-123047?
Upgrade the basyx chart to version 3.12.2, which fixes the issue.Source: cve.org, gitlab.eclipse.org