Eclipse aeriOS CVE-2026-86464

Requires that an operator deployed the pre-fix aeriOS IdM Helm chart or Docker Compose stack and left the shipped defaults in place: the Keycloak service and/or its PostgreSQL database must be network-reachable (Kubernetes NodePort exposes them on every node IP by default; Docker Compose binds PostgreSQL to all interfaces), and the fixed default Keycloak-admin / PostgreSQL credentials (or the known predefined dev/test user passwords) must not have been changed. Limiting factors: this exists only in unreleased development builds within the specified commit range, so there is no packaged production release carrying the flaw; exploitation is also gated on the attacker having network path to the exposed NodePort/DB port, and is neutralized entirely if defaults were rotated or the services were placed behind internal-only networking.

The CVSS 4.0 base score of 9.9 (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H, SC:H/SI:H) reflects the worst case: a network-reachable identity service compromised with published credentials, cascading into other systems that trust its tokens - and that worst case is technically accurate for the affected deployment mode. The tempering signal is maturity: the advisory explicitly states this is a development version with no official release, so the real-world installed base is minimal and there is no CISA KEV entry and no public exploit code identified. EPSS is not provided. The 'Authentication Bypass' and 'Information Disclosure' tags both fit loosely - the true impact exceeds mere disclosure (full identity-store read/write and token forgery). The practical exploitation bar is low wherever an operator actually stood up the vulnerable Helm/Compose config on a reachable network and left defaults in place; any team running the pre-fix deployment on an internet- or LAN-exposed node should treat it as urgent and rotate credentials immediately, but for most consumers the exposure window is limited by the fact that no packaged release shipped these defaults to production.

An attacker scans a Kubernetes cluster node or Docker host running the pre-fix aeriOS IdM and finds the Keycloak admin console or PostgreSQL port exposed via NodePort / all-interface binding. They authenticate using the credentials published in the public idm repository, gain administrative control of Keycloak (or read/write the database directly), and create a privileged user or forge tokens that downstream aeriOS components will honor. No exploit code is publicly identified, but exploitation requires nothing beyond the documented defaults and network reachability.