CVE-2026-46389

{
  "id": "CVE-2026-46389",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-05T19:16:32.703",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue."
    },
    {
      "lang": "es",
      "value": "UDS Identity Config construye la imagen de configuración de Keycloak (realm, plugins, tema, truststore, JARs) consumida por el despliegue de identidad de UDS Core. En las versiones 0.11.0 a 0.26.0, un error lógico en el autenticador de cliente de Keycloak “client-kubernetes-secret” (distribuido por “uds-identity-config” y consumido por UDS Core) provoca que el “client_secret” enviado sea sobrescrito con el secreto de Kubernetes montado antes de la comparación. Un atacante que puede alcanzar el endpoint de token de Keycloak y conoce un “client_id” que utiliza este autenticador puede autenticarse como ese cliente con cualquier valor de “client_secret” y obtener tokens OAuth2 con ámbito en la cuenta de servicio del cliente. En el caso del cliente “uds-operator”, este token puede ser utilizado para registrar/modificar otros clientes. La versión 0.26.1 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "defenseunicorns",
          "product": "uds-identity-config",
          "versions": [
            {
              "version": ">= 0.11.0, < 0.26.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-05T19:40:35.029663Z",
          "id": "CVE-2026-46389",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-303"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:defenseunicorns:uds_identity_config:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.11.0",
              "versionEndExcluding": "0.26.1",
              "matchCriteriaId": "A735ACF2-27DA-401E-BA79-6264BFC71C89"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/defenseunicorns/uds-identity-config/releases/tag/v0.26.1",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/defenseunicorns/uds-identity-config/security/advisories/GHSA-8mg2-6588-r4hw",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}