UDS Identity Config: Keycloak authenticator accepts any client_secret, granting service-account tokens

Impact

In the client-kubernetes-secret Keycloak authenticator shipped by uds-identity-config, the submitted client_secret is overwritten with the mounted Kubernetes secret before the comparison, so the comparison always succeeds. Anyone who can reach the Keycloak token endpoint and knows a client_id that uses this authenticator gets OAuth2 tokens scoped to that client's service account without knowing any secret. For the uds-operator client that token can register and modify other Keycloak clients, which turns a single token request into control over the cluster's identity configuration - the component every other UDS Core service authenticates against. Knowing the client_id is the only prerequisite, and client ids are not secrets.

Who can reach it

Any network attacker able to reach the Keycloak token endpoint who knows an affected client_id. No valid secret or prior authentication needed.

What to do

Upgrade uds-identity-config to 0.26.1 (affected: 0.11.0 through 0.26.0), rebuild the Keycloak configuration image and roll out the Identity deployment. Restrict the token endpoint to the cluster where possible, and review Keycloak client registrations and changes made while an affected version was running, since the patch does not undo anything an attacker already registered. Pod rollout plus image rebuild - no node maintenance.

References

Related entries

• VMware Avi Load Balancer: authentication bypass grants network access to the Avi control planeCVE-2026-47865 · VMware Avi Load Balancer (Avi Controller authentication)Critical
• rclone (rcd remote control server): An unauthenticated request to the rclone remote-control server instantiates aCVE-2026-49980 · rclone (rcd remote control server)Critical
• Proxmox VE (libpve-storage-perl XXE): XML external entity injection in the Proxmox storage library, reachableCVE-2026-51080 · Proxmox VE (libpve-storage-perl XXE)Critical
• Linux NFS server (nfsd, SECINFO_NO_NAME decode): A truncated SECINFO_NO_NAME operation leaves sin_exp uninitialized andCVE-2026-53398 · Linux NFS server (nfsd, SECINFO_NO_NAME decode)Critical
• Dell Virtual Storage Integrator: unauthenticated disclosure of active session credentials enables admin impersonationCVE-2026-54489 · Dell Virtual Storage Integrator for VMware vSphere Client (session handling)Critical
• Airflow FAB provider: Azure AD login accepted unsigned ID tokens, allowing login as AdminCVE-2026-59243 · Apache Airflow FAB auth manager (Azure AD OAuth ID token validation)Critical