CVE-2026-86464: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Eclipse Foundation Eclipse aeriOS

The vulnerability in Eclipse aeriOS's Identity Manager arises from insecure default configurations and credentials in the development version. Keycloak and PostgreSQL services were exposed through Kubernetes NodePort and Docker Compose on all network interfaces with fixed default credentials. This exposure allows attackers with network access to these services to gain administrative access to identity management data, including users, roles, client credentials, sessions, and cryptographic material. The vulnerability also includes predefined application users with known credentials intended for development and testing, which if used in production, increase risk. The vendor mitigated the issue by generating random Keycloak administrator passwords by default, managing credentials via Kubernetes Secrets, restricting PostgreSQL and OpenLDAP to internal services, and updating documentation to warn against using default development credentials in production.

An attacker able to reach the exposed Keycloak or PostgreSQL services could use default credentials to gain administrative access to the Identity Manager or direct database access. This could lead to unauthorized access or modification of sensitive identity-management data, creation of privileged identities or tokens, and compromise of other aeriOS components relying on these identities. The CVSS 4.0 score of 9.9 reflects critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability has been addressed by the vendor through generating random Keycloak administrator passwords by default, managing Keycloak and PostgreSQL credentials with Kubernetes Secrets, and restricting PostgreSQL and OpenLDAP services to internal access only. The predefined development and testing users remain but are explicitly documented as unsuitable for production use, with instructions to remove or change their credentials after installation. Users should upgrade to the fixed deployment configurations and follow the updated documentation to avoid using default credentials in production environments.