CVE-2026-46389 Details
Description
UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.
A client authentication bypass vulnerability has been identified in UDS Identity Config versions 0.11.0 prior to 0.26.0. The issue arises in the Keycloak client authenticator 'client-kubernetes-secret', which is used by UDS Core. A logic error allows the submitted 'client_secret' to be replaced with a Kubernetes secret before it is compared. This means that an attacker who can access the Keycloak token endpoint and knows a 'client_id' associated with this authenticator can authenticate as that client using any 'client_secret' value. As a result, the attacker can obtain OAuth2 tokens that are scoped to the client's service account. For instance, with the 'uds-operator' client, this token could be used to register or modify other clients.
Users are advised to upgrade to UDS Identity Config version 0.26.1 or later. If an immediate upgrade is not possible, the UDS Client Policy can be disabled temporarily, switch the 'uds-operator' client authentication to 'Client Id and Secret', and then patch the secret in-cluster. After upgrading to a fixed version, the 'Client Id and Kubernetes Secret' authenticator can be restored.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1 | [email protected] | ProductRelease Notes |
| https://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hw | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| defenseunicorns uds identity config | >= 0.11.0, < 0.26.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 5, 2026 | New CVE Received | [email protected] |