CVE-2026-123059
Received Received - Intake

Information Disclosure in Eclipse BaSyx Helm Charts

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Eclipse Foundation

Description
In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role. The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `<keycloak.fullnameOverride>-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment. The bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123059
EUVD
EUVD-2026-117437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse BaSyx Helm Charts 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In Eclipse BaSyx Helm Charts version 2.2.0, the aas-basyx-v2-full chart stores the OAuth2 client secret for the basyx-technical-user in plaintext within a Kubernetes ConfigMap when bundled Keycloak is enabled. This secret should be stored in a Secret but is also written to a Keycloak realm-import JSON file in the ConfigMap. An attacker with ConfigMap read access (e.g., via Kubernetes view ClusterRole) can extract the secret and use it to obtain an admin-level access token, granting full control over BaSyx repositories and registries.

Detection Guidance

Check for the presence of the vulnerable BaSyx Helm chart version 2.2.0 by running: helm list -a. Inspect ConfigMaps in the Keycloak namespace for the realm import JSON using: kubectl get configmaps -n <namespace> -o yaml. Look for the client secret of basyx-technical-user in plaintext within these ConfigMaps.

Impact Analysis

An attacker who gains access to the client secret can impersonate the basyx-technical-user OAuth2 client and obtain an admin token. This token allows full administrative privileges, including creating, reading, updating, deleting, and executing operations on all BaSyx repositories and registries in the deployment. The impact includes unauthorized data access, modification, or deletion, and potential compromise of the entire BaSyx environment.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of sensitive data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal or financial penalties due to inadequate access controls and secret management.

Mitigation Strategies

Migrate to the basyx chart or disable the bundled Keycloak. Rotate the basyx-technical-user client secret immediately. Restrict access to ConfigMaps by removing unnecessary permissions like the view ClusterRole for users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...