Eclipse BaSyx Helm Charts stores Keycloak admin password in cleartext
The admin password sits unprotected in a setup file, so others can peek at it.
Summary
In deployments that enable the bundled Keycloak, the Helm chart stores the passwords of the users it creates in plain text in a Kubernetes ConfigMap. This includes the default administrator, so anyone who can read ConfigMaps in the release namespace can log in as that administrator.
Affected when
- Bundled Keycloak enabled
- basyx chart 3.0.0-rc.1 through 3.12.1
What to do
Upgrade to basyx chart 3.12.2 and change the passwords of users created through the chart.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen