Keycloak OAuth2 Client Secret Exposed in Kubernetes ConfigMap

In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role. The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `<keycloak.fullnameOverride>-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and re

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Eclipse BaSyx Helm Charts version 2.2.0 contains a critical credential exposure vulnerability where the OAuth2 client secret for the `basyx-technical-user` is stored in cleartext within a Kubernetes ConfigMap. While the chart correctly writes this secret to a Kubernetes Secret resource, the Keycloak realm configuration template inadvertently duplicates the sensitive value in the ConfigMap—a world-readable resource by default. The affected `basyx-technical-user` service account holds realm admin privileges and uses the OAuth2 client-credentials grant flow, making this exposure particularly severe. Any attacker with read access to the cluster's ConfigMaps can extract this credential and impersonate a highly privileged service account, potentially gaining administrative control over the entire Keycloak realm and downstream services. This affects organizations deploying Eclipse BaSyx with Keycloak authentication enabled in Kubernetes environments.

Casky's 233 mapped security skills detect the attack patterns underlying this vulnerability through MITRE ATT&CK technique TA0006 (Credential Access). Claude AI with extended reasoning identifies the specific anti-patterns: credentials stored in non-secret resources, template logic that bypasses secret management controls, and privilege escalation paths through service account misuse. Practitioners using Casky would observe findings highlighting insecure configuration management practices, detection of credentials in ConfigMaps via static analysis, and visualization of how an attacker could pivot from initial ConfigMap access to OAuth2 token theft and administrative privilege escalation. The skill mapping would expose both the immediate vulnerability (cleartext storage) and downstream attack chains, enabling teams to understand not just what is misconfigured, but how adversaries would weaponize this exposure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-123059.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-123059

Casky has 233 skills that investigate the attack patterns behind CVE-2026-123059. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn