Is CVE-2026-123059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123059 being exploited in the wild.

How severe is CVE-2026-123059?

High severity, with a CVSS score of 7.5, published 5 November 2026.

Which products and versions are affected?

Eclipse BaSyx Helm Charts aas-basyx-v2-full 2.2.0.

Is there a fix for CVE-2026-123059?

No fixed version is recorded yet. Migrate to the separate `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret. [{"kind": "disclosed", "at": "2026-11-05"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-123059 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-123059?

Check whether you run Eclipse BaSyx Helm Charts aas-basyx-v2-full at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123059: Eclipse BaSyx Helm Charts cleartext OAuth2 client secret in ConfigMap

CVE-2026-123059 · Severity: high · CVSS 7.5 · Published 2026-11-05

Eclipse BaSyx Helm Charts version 2.2.0 deploys a Kubernetes application that manages industrial asset repositories. When Keycloak authentication is enabled, the admin credentials for a service account are stored unencrypted in a Kubernetes ConfigMap. Any user with read access to ConfigMaps—including those with the basic "view" role—can extract these credentials, gain admin access to all data repositories, and potentially modify or delete critical industrial asset information.

Vendors: Eclipse.

Quick answers

Is CVE-2026-123059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123059 being exploited in the wild.
How severe is CVE-2026-123059?: High severity, with a CVSS score of 7.5, published 5 November 2026.
Which products and versions are affected?: Eclipse BaSyx Helm Charts aas-basyx-v2-full 2.2.0.
Is there a fix for CVE-2026-123059?: No fixed version is recorded yet. Migrate to the separate `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-05"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123059 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-123059?: Check whether you run Eclipse BaSyx Helm Charts aas-basyx-v2-full at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Migrate to the separate `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-05"}]

Technical details

The vulnerability exists in the `basyx-keycloak-realm.yaml` template, which embeds the `keycloak.technicalUser.clientSecret` value into a Keycloak realm-import JSON file stored in a ConfigMap. Although the same secret is correctly stored in a Kubernetes Secret, the ConfigMap copies it in cleartext. An attacker with ConfigMap read permissions can extract the client secret, use the client-credentials OAuth2 grant to obtain an access token with admin realm role, and gain full CRUD and execute rights on all BaSyx repositories and registries.

Affected products

Eclipse BaSyx Helm Charts aas-basyx-v2-full 2.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.