EUVD-2026-34879Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Token endpoint is network-reachable, single request with any client_secret succeeds (AV:N/AC:L/PR:N/UI:N); compromise of uds-operator client yields full identity-plane control (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the client-kubernetes-secret Keycloak client authenticator (shipped by uds-identity-config and consumed by UDS Core) causes the submitted client_secret to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a client_id using this authenticator can authenticate as that client with any client_secret value and obtain OAuth2 tokens scoped to the client's service account. In the case of the uds-operator client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.
AnalysisAI
Authentication bypass in Defense Unicorns UDS Identity Config versions 0.11.0 through 0.26.0 allows remote unauthenticated attackers to obtain OAuth2 tokens for any Keycloak client using the client-kubernetes-secret authenticator by submitting an arbitrary client_secret value. A logic flaw in the custom authenticator overwrites the submitted secret with the mounted Kubernetes secret prior to comparison, rendering the comparison meaningless. With EPSS at 0.04% there is no public exploit identified at time of analysis, but the SSVC technical impact is rated total and exploitation is automatable, making this a high-priority patch for UDS Core operators.
Technical ContextAI
UDS Identity Config builds a Keycloak configuration image (realm definitions, plugins, custom themes, truststore, JAR extensions) that is consumed by the UDS Core Identity deployment, a Defense Unicorns Kubernetes platform commonly used in regulated and DoD-adjacent environments. The vulnerable component is a custom Keycloak Service Provider Interface (SPI) authenticator named client-kubernetes-secret, which is intended to authenticate OAuth2 clients by comparing the client_secret supplied at the token endpoint against a secret value mounted from a Kubernetes Secret into the Keycloak pod. The CWE-287 (Improper Authentication) root cause here is a classic credential-comparison logic error: the authenticator assigns the trusted mounted secret value into the same variable that holds the attacker-supplied secret before performing the equality check, so the comparison always succeeds. CPE cpe:2.3:a:defenseunicorns:uds-identity-config:*:*:*:*:*:*:*:* identifies the affected package, and the impact extends to any downstream UDS Core deployment that uses this authenticator - most critically the uds-operator client, which has permissions to register and modify other Keycloak clients.
RemediationAI
Vendor-released patch: upgrade UDS Identity Config to version 0.26.1 or later, available at https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1, and redeploy UDS Core so the corrected Keycloak configuration image is loaded. Operators should also review Keycloak audit logs and service-account token issuance for clients using the client-kubernetes-secret authenticator (especially uds-operator) for anomalous token grants prior to patching, and rotate any client secrets and downstream credentials issued to those service accounts. If immediate patching is not feasible, compensating controls include temporarily switching affected Keycloak clients off the client-kubernetes-secret authenticator to standard client secret or mTLS authentication (trade-off: requires re-issuing secrets to all legitimate consumers), and restricting network reachability of the Keycloak /token endpoint via NetworkPolicy or ingress ACLs to known internal CIDRs (trade-off: may break legitimate workloads that authenticate from unexpected sources). Consult the vendor advisory at https://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hw for authoritative guidance.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today