CVE-2026-123047: Cleartext Keycloak Passwords in a Kubernetes ConfigMap
A vulnerability tracked as CVE-2026-123047 affects the Eclipse BaSyx Helm Charts. In versions 3.0.0-rc.1 through 3.12.1 of the basyx chart, deployments that enable the bundled Keycloak store the passwords of the Keycloak users the chart creates in cleartext inside a Kubernetes ConfigMap.
NVD lists a CVSS score of 7.5 (High).
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-123047 |
| CVSS Score | 7.5 (High) |
| Component | Eclipse BaSyx Helm Charts, basyx chart |
| Affected versions | 3.0.0-rc.1 through 3.12.1 |
| Condition | Bundled Keycloak enabled |
| Published | 2026-11-05 |
The chart template keycloak-init-config.yaml renders the initial Keycloak user definitions, including their passwords, into a ConfigMap. ConfigMaps are not designed for secret material. They are not encrypted at rest by default and are typically readable by a much wider set of cluster principals than Secrets.
Impact
- Anyone with
getorlistaccess to ConfigMaps in the release namespace can read the Keycloak user passwords. - Passwords can also leak through GitOps tooling,
helm get manifest,kubectl describe, backups, and logging or audit pipelines that capture ConfigMap contents. - Because Keycloak fronts the BaSyx components, recovered credentials may grant access to the identity layer of the deployment.
Remediation
- Check the NVD entry and the Eclipse BaSyx Helm chart repository for the fixed chart version, and upgrade past 3.12.1.
- Rotate every Keycloak user password the chart created. Treat all existing values as compromised, because they may already sit in cluster backups or Git history.
- Review RBAC so ConfigMap read access is limited to the principals that need it.
- Where possible, supply credentials through Kubernetes Secrets or an external secret manager, not chart values that render into ConfigMaps.
- Audit ConfigMap read activity in the affected namespaces for unexpected access.
Detection
Check whether a release is exposed:
helm list -A | grep basyx
kubectl get configmap -n NAMESPACE -o yaml | grep -i -B2 -A2 passwordReplace NAMESPACE with the release namespace. Any plaintext password in the output means the deployment is affected.