CVE-2026-123047

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-123047
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123047.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-123047
Aliases
Published
2026-11-05T12:11:12Z
Modified
2026-11-06T10:30:57Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
Details

In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the basyx chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap.

The template keycloak-init-config.yaml rendered keycloak.initialization.users, including each user's credentials[].value, as users.json into the persistent ConfigMap <release>-basyx-keycloak-init-config. By default this includes the bootstrap administrator user. That user holds the admin role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes view ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the admin role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment.

The bundled Keycloak is disabled by default. The issue is fixed in version 3.12.2 of the basyx chart, which moves the initialization users to the Keycloak credentials Secret. Affected users should upgrade and change the passwords of users that were created through the chart.

Database specific 
{
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-312",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123047.json"
}
References

Affected packages

Git / github.com/eclipse-basyx/charts

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-basyx/charts
Events
Introduced
885029611724eb43fb243ed4546918435c8511f8
Fixed
f516946cdccc49296e3aa8d2764b02541e26fc6f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.0.0-rc.1"
                },
                {
                    "fixed": "3.12.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "basyx-3.12.2",
            "range": [
                {
                    "fixed": "f516946cdccc49296e3aa8d2764b02541e26fc6f"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

basyx-3.*
basyx-3.0.0
basyx-3.0.0-rc.1
basyx-3.0.0-rc.2
basyx-3.0.0-rc.3
basyx-3.0.1
basyx-3.1.0
basyx-3.10.0
basyx-3.10.1
basyx-3.11.0
basyx-3.11.1
basyx-3.11.2
basyx-3.11.3
basyx-3.12.0
basyx-3.12.1
basyx-3.2.0
basyx-3.3.0
basyx-3.3.1
basyx-3.3.2
basyx-3.4.0
basyx-3.5.0
basyx-3.6.0
basyx-3.7.0
basyx-3.8.0
basyx-3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123047.json"