PT-2026-47027 · Defenseunicorns · Uds-Identity-Config

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-46389

NVD

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the client-kubernetes-secret Keycloak client authenticator (shipped by uds-identity-config and consumed by UDS Core) causes the submitted client secret to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a client id using this authenticator can authenticate as that client with any client secret value and obtain OAuth2 tokens scoped to the client's service account. In the case of the uds-operator client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

Related Identifiers

CVE-2026-46389

Affected Products

Uds-Identity-Config

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-46389 · Security Note
• https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1 · Note
• https://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hw · Note