CVE-2026-123047
Description
A flaw was found in the Eclipse BaSyx Helm chart. When the bundled Keycloak identity service is enabled, initialization user credentials—including the bootstrap administrator password—are stored in plaintext within a Kubernetes ConfigMap instead of a protected Secret. A user or service account with read access to ConfigMaps within the release namespace can retrieve these credentials and authenticate as an administrator. This allows the attacker to achieve privilege escalation and gain full administrative control over all deployed APIs.
Statement
Red Hat rates this vulnerability as having an Important impact because exposure of administrative authentication credentials allows users with low-level read permissions to escalate privileges and gain full administrative authority over the deployment. This flaw resides specifically within the packaging templates of the third-party Eclipse BaSyx Helm chart rather than Keycloak itself. No supported Red Hat products package or distribute the affected chart, meaning standard Red Hat environments are not directly exposed.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to store Keycloak initialization credentials in a protected Kubernetes Secret instead of rendering them into a persistent ConfigMap: upgrade to basyx chart 3.12.2, which move Keycloak initialization user definitions from the initialization ConfigMap into the credentials Secret and mount them read-only, closing all 2 injection vectors (ConfigMap credential harvesting, unauthorized administrative authentication via extracted credentials). Until patched, this is only a concern on Deployments of the Eclipse BaSyx Helm chart with the bundled Keycloak identity service enabled — Deployments where the bundled Keycloak identity service is disabled are unaffected — so Restrict read access to ConfigMaps in the release namespace, monitor access to the initialization ConfigMap, and rotate passwords for users created by the chart. As a compensating measure, Configure Kubernetes API Server Audit Policy to log read requests to ConfigMaps in the release namespace to detect harvesting of plaintext administrative credentials. These controls limit blast radius and contain exploitation, but they do not fix the underlying cleartext credential storage defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1011 Kubernetes API Server Audit Policy (medium)
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
This can result in compromise of the system for which the password is used. An attacker could gain access to this file and learn the stored password or worse yet, change the password to one of their choosing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
