Cleartext Password Storage in Kubernetes ConfigMaps

In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template `keycloak-init-config.yaml` rendered `keycloak.initialization.users`, including each user's `credentials[].value`, as `users.json` into the persistent ConfigMap `<release>-basyx-keycloak-init-config`. By default this includes the bootstrap administrator user. That user holds the `admin` role and has a non-temporary password. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the password from the ConfigMap and log in to Keycloak as this user. The resulting token carries the `admin` role, which the default BaSyx ABAC rules map to full rights on all BaSyx APIs in the deployment. The bundled Keycloak is disabled by default. The issue is fixed

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 through 3.12.1 expose a critical credential management flaw where Keycloak user passwords are stored in plaintext within Kubernetes ConfigMaps. This vulnerability affects any organization deploying BaSyx with bundled Keycloak authentication enabled, potentially exposing bootstrap administrator credentials and all user passwords to anyone with read access to cluster ConfigMaps. ConfigMaps are not encrypted by default in Kubernetes, making this a significant supply chain and secrets management risk that violates fundamental security principles around credential protection.

Casky's 233 matched security skills leverage Claude's extended reasoning to identify this Credential Access (TA0006) pattern by analyzing infrastructure-as-code templates, Kubernetes manifests, and runtime configurations. Practitioners would see findings flagged for: cleartext credential storage in non-secret Kubernetes objects, improper use of ConfigMaps for sensitive data instead of Secrets, exposed authentication initialization files in persistent volumes, and inadequate secrets management in Helm chart deployments. The platform would correlate CWE-312 (cleartext storage) and CWE-522 (insufficiently protected credentials) violations against MITRE ATT&CK reconnaissance and credential access techniques, highlighting the specific render chain where `keycloak.initialization.users` and `credentials[].value` fields become exposed in the `<release>-basyx-keycloak-init-config` ConfigMap.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-123047.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-123047

Casky has 233 skills that investigate the attack patterns behind CVE-2026-123047. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn