Threats tagged 'ghsa-86r8-p43m-77rx'

Eclipse BaSyx Helm Charts version 2.2.0 of the aas-basyx-v2-full chart with bundled Keycloak enabled stores the client secret of the basyx-technical-user OAuth2 client in cleartext within a Kubernetes ConfigMap. This client has admin privileges in the Keycloak realm. Because ConfigMaps are readable by principals with the Kubernetes view ClusterRole, an attacker with such access can retrieve the secret, exchange it for an admin access token, and gain full control over BaSyx repositories and registries. The bundled Keycloak is disabled by default, and no fixed release of the affected chart exists. Users are advised to migrate to the basyx chart or deploy without bundled Keycloak and rotate the client secret.