Cleartext Password Storage Vulnerability in Eclipse BaSyx Helm Charts by Eclipse
CVE-2026-123047

7.5HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Basyx Helm Charts
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123047?

The Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 contain a significant security issue where passwords for Keycloak users, including the default administrator, are stored in cleartext within a Kubernetes ConfigMap. This exposes sensitive credentials to any principal capable of reading ConfigMaps, such as those with the built-in Kubernetes view ClusterRole. Their access could lead to unauthorized administrative actions in the BaSyx deployment. The vulnerability has been addressed in version 3.12.2, which relocates these usernames and passwords to a secured Kubernetes secret, enhancing protection against potential breaches. Users are strongly advised to upgrade and change their passwords immediately.

Affected Version(s)

Eclipse BaSyx Helm Charts 3.0.0-rc.1 < 3.12.2

References

https://github.com/eclipse-basyx/charts/security/advisori...
https://github.com/eclipse-basyx/charts/pull/106
https://github.com/eclipse-basyx/charts/releases/tag/basy...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eclipse Foundation Security Team
.