Summary
When the bundled Keycloak is enabled, the BaSyx Helm chart can place generated user passwords—including the bootstrap administrator's password—in a Kubernetes ConfigMap. A principal who can read that ConfigMap may be able to log in as the administrator and gain full access to BaSyx APIs.
When the bundled Keycloak is enabled, the BaSyx Helm chart can place generated user passwords—including the bootstrap administrator's password—in a Kubernetes ConfigMap. A principal who can read that ConfigMap may be able to log in as the administrator and gain full access to BaSyx APIs.
Affected context
The issue affects BaSyx basyx chart deployments that enable the bundled Keycloak and render initialization users into the persistent <release>-basyx-keycloak-init-config ConfigMap. The bundled Keycloak is disabled by default, so deployments that do not enable it are not exposed through this configuration path. The ConfigMap may include a bootstrap administrator account with a non-temporary password.
The issue affects BaSyx basyx chart deployments that enable the bundled Keycloak and render initialization users into the persistent <release>-basyx-keycloak-init-config ConfigMap. The bundled Keycloak is disabled by default, so deployments that do not enable it are not exposed through this configuration path. The ConfigMap may include a bootstrap administrator account with a non-temporary password.
Exploit preconditions
- Attack surface: Kubernetes API access to ConfigMaps in the release namespace
- Required access: Permission to read the Keycloak initialization ConfigMap; Secret-read permission is not required
- Trigger point: The principal reads the ConfigMap and uses an exposed password to authenticate to the bundled Keycloak
- Why exploitation is possible: User credentials are stored in cleartext in a resource accessible to principals with ConfigMap read access, and the bootstrap account has the
adminrole
- Attack surface: Kubernetes API access to ConfigMaps in the release namespace
- Required access: Permission to read the Keycloak initialization ConfigMap; Secret-read permission is not required
- Trigger point: The principal reads the ConfigMap and uses an exposed password to authenticate to the bundled Keycloak
- Why exploitation is possible: User credentials are stored in cleartext in a resource accessible to principals with ConfigMap read access, and the bootstrap account has the
adminrole
Why this happens
The chart renders initialization-user credentials, including password values, into a persistent Kubernetes ConfigMap. ConfigMaps are not designed to protect sensitive data like passwords, so storing credentials there exposes them to principals who can read ConfigMaps. This is primarily CWE-312: Cleartext Storage of Sensitive Information, and is also related to CWE-522: Insufficiently Protected Credentials.
The chart renders initialization-user credentials, including password values, into a persistent Kubernetes ConfigMap. ConfigMaps are not designed to protect sensitive data like passwords, so storing credentials there exposes them to principals who can read ConfigMaps. This is primarily CWE-312: Cleartext Storage of Sensitive Information, and is also related to CWE-522: Insufficiently Protected Credentials.
Potential impact
- A reader of the ConfigMap could obtain credentials for a Keycloak user.
- Use of the bootstrap administrator's credentials could grant the attacker a Keycloak token with the
adminrole. - The resulting access could allow full rights to BaSyx APIs under the default ABAC rules.
- Compromised accounts could be used to alter data or application configuration, depending on available API capabilities.
- A reader of the ConfigMap could obtain credentials for a Keycloak user.
- Use of the bootstrap administrator's credentials could grant the attacker a Keycloak token with the
adminrole. - The resulting access could allow full rights to BaSyx APIs under the default ABAC rules.
- Compromised accounts could be used to alter data or application configuration, depending on available API capabilities.
General mitigation guidance
Defensive patterns include keeping passwords and other credentials out of ConfigMaps and placing them in appropriately protected Secret resources or an external secrets manager. Limit access to credential-bearing resources using least-privilege RBAC, and avoid exposing secrets in rendered manifests, logs, or other broadly readable artifacts. Use unique, non-default credentials, rotate any credentials that may have been exposed, and disable bundled components that are not needed.
Defensive patterns include keeping passwords and other credentials out of ConfigMaps and placing them in appropriately protected Secret resources or an external secrets manager. Limit access to credential-bearing resources using least-privilege RBAC, and avoid exposing secrets in rendered manifests, logs, or other broadly readable artifacts. Use unique, non-default credentials, rotate any credentials that may have been exposed, and disable bundled components that are not needed.
How teams detect issues like this
- Review chart templates and rendered manifests for password values or credential fields written to ConfigMaps.
- Use static analysis or policy checks to flag sensitive-key names and credential-like values in non-secret Kubernetes resources.
- Audit RBAC bindings for principals that can read ConfigMaps in namespaces where the bundled Keycloak is enabled.
- Monitor Keycloak authentication and BaSyx API audit logs for unexpected administrator logins or activity.
- Review chart templates and rendered manifests for password values or credential fields written to ConfigMaps.
- Use static analysis or policy checks to flag sensitive-key names and credential-like values in non-secret Kubernetes resources.
- Audit RBAC bindings for principals that can read ConfigMaps in namespaces where the bundled Keycloak is enabled.
- Monitor Keycloak authentication and BaSyx API audit logs for unexpected administrator logins or activity.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| gitlab. | gitlab.eclipse.org/ |
