OAuth2 Client Secret Exposure in Eclipse BaSyx Helm Charts

CVE-2026-123059

What is CVE-2026-123059?

The Eclipse BaSyx Helm Charts version 2.2.0 contains a vulnerability where the client secret for the basyx-technical-user OAuth2 client is stored in cleartext within a Kubernetes ConfigMap. Although the chart appropriately stores the client secret in a Kubernetes Secret, it mistakenly inserts the same secret into the Keycloak realm-import JSON within the ConfigMap. This misconfiguration poses a risk, as a user with view access (who can read ConfigMaps but not Secrets) can access the cleartext client secret. By leveraging this secret at the Keycloak token endpoint, the malicious actor can obtain an access token with admin privileges, enabling them to manipulate BaSyx repositories and registries. Users are advised to migrate to the basyx chart or deploy without the bundled Keycloak, while also rotating the basyx-technical-user client secret to mitigate this exposure.

References