Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
Only the aas-basyx-v2-full chart at version 2.2.0 with the bundled Keycloak enabled is covered. No vendor rating is given, and no fixed chart release exists.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Bundled Keycloak must be enabled (keycloak.enabled=true) Affected chart is aas-basyx-v2-full version 2.2.0 Attacker must be able to read ConfigMaps but not Secrets in the release namespace (e.g. holder of the built-in Kubernetes view ClusterRole)
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Eclipse BaSyx Helm Charts (the aas-basyx-v2-full chart with the bundled Keycloak enabled) stores a Keycloak client secret in cleartext in a Kubernetes ConfigMap, so a remote attacker with low privileges can read it. Using the secret, the attacker can obtain an admin-role token that grants full create, read, update, and delete access to all BaSyx repositories and registries in the deployment.
Read the original description
In Eclipse BaSyx Helm Charts version 2.2.0 of the aas-basyx-v2-full chart, deployments with the bundled Keycloak enabled store the client secret of the basyx-technical-user OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm admin role.
The chart correctly writes keycloak.technicalUser.clientSecret to a Kubernetes Secret, but the template basyx-keycloak-realm.yaml also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap <keycloak.fullnameOverride>-realm. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes view ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the admin role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment.
The bundled Keycloak is disabled by default. No fixed release of the aas-basyx-v2-full chart exists. Affected users should migrate to the basyx chart, or deploy without the bundled Keycloak and rotate the basyx-technical-user client secret.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.5/10CVSS 7.5, total technical impact per CISA
- No patch5/5No patch listed yet
What would change the score
- Would score about 72 if added to CISA KEV
- Would score about 67 if CISA's SSVC rates exploitation active
- Would score about 29 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Bundled Keycloak must be enabled (keycloak.enabled=true) Affected chart is aas-basyx-v2-full version 2.2.0 Attacker must be able to read ConfigMaps but not Secrets in the release namespace (e.g. holder of the built-in Kubernetes view ClusterRole)Workaround: Deploy without the bundled Keycloak and rotate the basyx-technical-user client secret.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Eclipse Foundation Eclipse BaSyx Helm Charts
2.2.0
Evidence 4
- Advisory
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123059
Is CVE-2026-123059 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The chart stores the basyx-technical-user Keycloak client secret in a ConfigMap in cleartext. A principal that can read ConfigMaps but not Secrets in the release namespace can read the secret and use it to get an admin realm token. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment.Source: cve.org, gitlab.eclipse.org
Which versions are affected by CVE-2026-123059?
Eclipse BaSyx Helm Charts: version 2.2.0.Source: cve.now feed data
Am I affected, and how do I check?
The issue is in version 2.2.0 of the aas-basyx-v2-full chart and requires keycloak.enabled=true. To check, look at the chart version in the Helm release and at the keycloak.enabled value in the release values. The exposure applies to principals that can read ConfigMaps but not Secrets in the namespace, such as holders of the built-in Kubernetes view ClusterRole.Source: cve.org, gitlab.eclipse.org
How do I fix CVE-2026-123059?
No fixed release of the aas-basyx-v2-full chart exists. The stated workaround is to deploy without the bundled Keycloak and to rotate the basyx-technical-user client secret.Source: cve.org, gitlab.eclipse.org
What if there's no patch?
While no fix exists, the workaround is to deploy without the bundled Keycloak and rotate the basyx-technical-user client secret. This limits the affected feature, since the flaw depends on the bundled Keycloak being enabled.Source: cve.org, gitlab.eclipse.org