CVE-2026-46389

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.

• CWE-287
• CWE-303

• https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1Product, Release Notes
• https://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hwMitigation, Vendor Advisory

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46378Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-46383Microsoft APM is an open-source, community-driven dependency…5.5
• CVE-2026-46384iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, se…8.7
• CVE-2026-46385iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, th…8.7
• CVE-2026-46386OpenProject is open-source, web-based project management sof…9.9
• CVE-2026-46388osquery is a SQL powered operating system instrumentation, m…4.4
• CVE-2026-4639Vitals ESP developed by Galaxy Software Services has a Incor…8.8
• CVE-2026-46390HAX CMS helps manage microsite universe with PHP or NodeJs b…6.9
• CVE-2026-46391HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46392HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46393HAX CMS helps manage microsite universe with PHP or NodeJs b…7.1
• CVE-2026-46394HAX CMS helps manage microsite universe with PHP or NodeJs b…7.7