CVE-2026-86464

Deferred Deferred - Pending Action

Hard-Coded Credentials in Eclipse aeriOS Identity Manager

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: Eclipse Foundation

Description

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL backing database through Kubernetes NodePort services by default, while the Docker Compose deployment similarly exposed PostgreSQL on all network interfaces. The deployment included fixed default credentials for the Keycloak administrator and PostgreSQL database user, and the previous Helm chart configuration did not provide adequate secret management for these credentials. In addition, predefined application users with known credentials were provided for development and testing without sufficiently warning operators against their use in production environments. An attacker able to reach the exposed services could use the published default credentials to obtain administrative access to the Identity Manager or direct access to its database. This could allow unauthorized access to or modification of identity-management data, including users, roles, client credentials, sessions, and cryptographic material, and could enable the creation of privileged identities or tokens accepted by other aeriOS components. The issue has been addressed by generating a random Keycloak administrator password by default, managing Keycloak and PostgreSQL credentials through Kubernetes Secrets, and restricting PostgreSQL to an internal service in both the Helm chart and Docker Compose deployment. OpenLDAP is also restricted to an internal service. The predefined users intended for development and testing are retained, but the documentation now explicitly warns that their default credentials must not be used in production and that these users should be removed or their credentials changed after installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86464

Affected Vendors & Products

Vendor	Product	Version / Range
eclipse	aerios	*
keycloak	keycloak	*
postgresql	postgresql	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-1392	The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-86464 involves insecure default configurations in Eclipse aeriOS's Identity Manager (IdM) deployment. The Helm chart and Docker Compose setup exposed Keycloak and PostgreSQL services externally using NodePort by default, allowing unauthenticated access. Hardcoded credentials for Keycloak admin (admin:Pa55w0rd) and PostgreSQL (keycloak:password) were used, enabling attackers to gain administrative access to the IdM or database. This could lead to unauthorized access or modification of identity data, creation of privileged identities, or token forgery.

Detection Guidance

Check for exposed Kubernetes NodePort services on ports 30000-32767 using 'kubectl get svc' or 'kubectl describe svc'. Verify if Keycloak or PostgreSQL services are exposed externally. Inspect Helm values.yaml for hardcoded credentials like 'admin:Pa55w0rd' or 'keycloak:password'.

Impact Analysis

An attacker could exploit this vulnerability to gain full administrative access to the Identity Manager or direct access to its database. This may allow unauthorized access to or modification of sensitive identity data, including users, roles, and cryptographic material. Attackers could create privileged identities or forge tokens accepted by other aeriOS components, potentially bypassing authentication across the entire platform.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR (Article 32 on security of processing) and HIPAA (Access Control and Audit Controls rules). Exposure of default credentials and external service access could lead to unauthorized data access, breaches of confidentiality, and lack of proper authentication mechanisms, resulting in non-compliance with these standards.

Mitigation Strategies

Change all default credentials immediately. Restrict PostgreSQL and Keycloak services to ClusterIP instead of NodePort. Enable Kubernetes Secrets for credential management. Remove predefined development users or change their passwords. Update to patched versions of Helm charts or Docker Compose files.

Hi! I’m here to help you understand CVE-2026-86464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70