CVE-2026-123047
Received Received - Intake

Hard-Coded Credentials in Eclipse BaSyx Helm Charts

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Eclipse Foundation

Description
In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap `<release>-basyx-keycloak-init-config`. By default this includes the bootstrap administrator user. That user holds the `admin` role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the `admin` role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment. The bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the `basyx` chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123047
EUVD
EUVD-2026-117416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse BaSyx Helm Charts 3.0.0-rc.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1. When Keycloak is enabled, user passwords including the bootstrap admin are stored in cleartext in a Kubernetes ConfigMap. An attacker with read access to ConfigMaps can extract these passwords and gain admin access to Keycloak, which grants full rights on all BaSyx APIs due to default ABAC rules.

Detection Guidance

Check for the presence of the vulnerable ConfigMap in your Kubernetes cluster using kubectl get configmap. Look for a ConfigMap named <release>-basyx-keycloak-init-config. If found, inspect its contents with kubectl get configmap <release>-basyx-keycloak-init-config -o yaml to see if passwords are stored in cleartext.

Impact Analysis

An attacker with view ClusterRole access could read the ConfigMap, obtain admin credentials, and gain full control over the BaSyx deployment. This includes unauthorized access to all APIs and data managed by the system.

Compliance Impact

Storing passwords in cleartext violates data protection requirements in GDPR and HIPAA, which mandate encryption of sensitive credentials. This could lead to compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade to Eclipse BaSyx Helm Charts version 3.12.2 or later. After upgrading, change the passwords of all users that were created through the chart, as they may have been exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...