CVE-2026-46389
Authentication Bypass in UDS Identity Config
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uds_identity_config | client_kubernetes_secret | From 0.11.0 (inc) to 0.26.0 (inc) |
| uds_identity_config | client_kubernetes_secret | 0.26.1 |
| defenseunicorns | uds-identity-config | From 0.11.0 (inc) to 0.26.1 (exc) |
| defenseunicorns | uds-identity-config | 0.26.1 |
| defenseunicorns | uds-core | From 0.39.0 (inc) to 1.2.1 (exc) |
| defenseunicorns | uds-core | 1.0.1 |
| defenseunicorns | uds-core | 1.1.1 |
| defenseunicorns | uds-core | 1.2.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-303 | The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the uds-identity-config component, specifically in the ClientIdAndKubernetesSecretAuthenticator used by UDS Core's Identity deployment. Due to a logic error, the submitted client_secret is overwritten with a mounted Kubernetes secret before comparison, allowing an attacker who can reach the Keycloak token endpoint and knows a client_id to authenticate as that client using any client_secret value.
This flaw enables unauthorized access to OAuth2 tokens scoped to the client's service account, including privileged clients like uds-operator, which can then be used to create, modify, or delete OIDC clients.
The vulnerability affects versions 0.11.0 through 0.26.0 of uds-identity-config and was patched in version 0.26.1.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows an attacker to bypass client authentication and obtain OAuth2 tokens with the privileges of the targeted client.
- Unauthorized access to sensitive OAuth2 tokens.
- Potential for privilege escalation by using tokens from privileged clients like uds-operator.
- Ability for attackers to create, modify, or delete OIDC clients, leading to further credential theft or unauthorized access.
- High impact on confidentiality, integrity, and availability of the affected systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reviewing Keycloak event logs for suspicious activity, such as unexpected client operations or unauthorized token requests involving the affected clients.
Specifically, monitoring the Keycloak token endpoint for unusual authentication attempts where any client_secret value is accepted for a known client_id using the vulnerable authenticator can indicate exploitation.
While no specific commands are provided in the resources, administrators should query Keycloak logs for events related to the uds-operator client or other clients using the client-kubernetes-secret authenticator.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading uds-identity-config to version 0.26.1 or later, which contains the patch for this vulnerability.
For UDS Core deployments, upgrade to patched versions of UDS Core (v1.0.1, v1.1.1, or v1.2.2) that include fixes for this issue.
As a temporary workaround, switch the uds-operator client authentication mechanism from the vulnerable Kubernetes secret authenticator to the Client ID and Secret authenticator.
Additionally, review and apply client policy restrictions to limit the scope of operations that can be performed with tokens obtained via this authenticator.
Finally, monitor Keycloak event logs closely for any suspicious activity to detect potential exploitation attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to bypass client authentication and obtain OAuth2 tokens with high privileges, including the ability to create, modify, or delete OIDC clients. Such unauthorized access and potential privilege escalation can lead to unauthorized disclosure, modification, or disruption of sensitive data and services.
Given the critical impact on confidentiality, integrity, and availability of authentication tokens and client configurations, this vulnerability could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and systems.
Organizations using affected versions should remediate promptly to maintain compliance by preventing unauthorized access and ensuring proper authentication mechanisms are in place.