EUVD-2026-34879CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the client-kubernetes-secret Keycloak client authenticator (shipped by uds-identity-config and consumed by UDS Core) causes the submitted client_secret to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a client_id using this authenticator can authenticate as that client with any client_secret value and obtain OAuth2 tokens scoped to the client's service account. In the case of the uds-operator client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.
AnalysisAI
Authentication bypass in Defense Unicorns UDS Identity Config versions 0.11.0 through 0.26.0 allows unauthenticated remote attackers to impersonate any Keycloak client that uses the client-kubernetes-secret authenticator by submitting an arbitrary client_secret to the token endpoint. Because compromising the uds-operator client enables registration and modification of other Keycloak clients, this maximum-severity (CVSS 10.0) flaw can cascade into full identity-plane takeover of a UDS Core deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the targeted Keycloak instance's OAuth2 token endpoint deployed via UDS Core's Identity component, (2) knowledge of a `client_id` whose Keycloak client is configured to use the `client-kubernetes-secret` authenticator shipped by UDS Identity Config 0.11.0-0.26.0 (the high-value target is the `uds-operator` client, whose ID is well-known in UDS Core), and (3) the affected version range being deployed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H maxes out at 10.0 and is consistent with the description: the Keycloak token endpoint is reachable over the network, no privileges or user interaction are needed, and scope changes because authentication as `uds-operator` lets the attacker pivot to controlling other Keycloak clients (a different trust domain). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Keycloak token endpoint of a UDS Core deployment (for example via an exposed ingress or from a compromised in-cluster pod) issues an OAuth2 client_credentials request to `/realms/uds/protocol/openid-connect/token` with `client_id=uds-operator` and any arbitrary `client_secret` such as `x`. The vulnerable authenticator overwrites the submitted secret with the mounted Kubernetes Secret before comparison, so the token endpoint returns a valid access token scoped to the `uds-operator` service account. … |
| Remediation | Vendor-released patch: upgrade UDS Identity Config to v0.26.1 or later (https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1) and redeploy the Keycloak configuration image so UDS Core picks up the corrected `client-kubernetes-secret` authenticator; review the advisory at https://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hw for any required follow-up steps. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all deployments running UDS Identity Config versions 0.11.0-0.26.0; audit Keycloak clients configured with the client-kubernetes-secret authenticator; review recent authentication logs for suspicious client token requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local privilege escalation and code execution in Microsoft Azure Kubernetes Service (AKS) is possible via a path travers
Privilege bypass in Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.2.x allows remote unauthenticated attackers t
SQL injection in Red Hat's kubev2v migration-planner allows a remote authenticated attacker to upload a crafted RVTools
{id}) or delete (DELETE /api/projects) any project on the platform, triggering cascading deletion of associated Function
Sensitive credential disclosure in Sidero Labs Omni (versions 1.3.0–1.6.5 and 1.7.0–1.7.2) allows authenticated users wi
Share
External POC / Exploit Code
Leaving vuln.today