Read the docs
TI-2026-85396 Aliases CVE-2026-123047GHSA-37v5-fgfq-pwwf

Cleartext Keycloak admin password in ConfigMap in Eclipse BaSyx Helm Charts

Priority LOW 34CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the basyx chart store the passwords of Keycloak users the chart creates in cleartext in a Kubernetes ConfigMap when bundled Keycloak is enabled. The default bootstrap administrator, which holds the admin role and has a non-temporary password, is included. A principal who can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes view ClusterRole, can log in to Keycloak as that administrator. By default, the admin role maps to full rights on all BaSyx APIs.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap `<release>-basyx-keycloak-init-config`. By default this includes the bootstrap administrator user. That user holds the `admin` role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the `admin` role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment. The bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the `basyx` chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Fixed Eclipse BaSyx Helm Charts (Eclipse Foundation): 3.12.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse BaSyx Helm Charts3.0.0-rc.1 to before 3.12.23.12.2Patch availableCNA
  • Eclipse BaSyx Helm Charts VendorEclipse Foundation Affected 3.0.0-rc.1 to before 3.12.2 Fixed in 3.12.2 Patch available CNA

Remediation

Upgrade the basyx chart to 3.12.2, which moves the initialization users to the Keycloak credentials Secret. Change the passwords of users that were created through the chart.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Eclipse BaSyx Helm Charts (Eclipse Foundation) Fixed in 3.12.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123047
  2. 2026-11-05 Alias added: GHSA-37v5-fgfq-pwwf
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences