Eclipse BaSyx Helm Charts stores bundled Keycloak client secret in cleartext
The admin key of a server deployment tool is stored where anyone can read it.
Summary
With the bundled Keycloak enabled in Eclipse BaSyx Helm Charts 2.2.0 (aas-basyx-v2-full chart), the client secret is stored in cleartext in a ConfigMap. A user who can read it can manage all BaSyx repositories and registries in the deployment.
Affected when
- Bundled Keycloak enabled
- A principal that can read ConfigMaps in the release namespace (e.g., holder of the view ClusterRole)
What to do
No fixed release exists. Migrate to the basyx chart, or deploy without the bundled Keycloak and rotate the basyx-technical-user client secret.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen