CVE-2026-86464: Infoleak
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services.
The Helm chart exposed the Keycloak service and its PostgreSQL backing database through Kubernetes NodePort services by default, while the Docker Compose deployment similarly exposed PostgreSQL on all network interfaces. The deployment included fixed default credentials for the Keycloak administrator and PostgreSQL database user, and the previous Helm chart configuration did not provide adequate secret management for these credentials. In addition, predefined application users with known credentials were provided for development and testing without sufficiently warning operators against their use in production environments.
An attacker able to reach the exposed services could use the published default credentials to obtain administrative access to the Identity Manager or direct access to its database. This could allow unauthorized access to or modification of identity-management data, including users, roles, client credentials, sessions, and cryptographic material, and could enable the creation of privileged identities or tokens accepted by other aeriOS components.
The issue has been addressed by generating a random Keycloak administrator password by default, managing Keycloak and PostgreSQL credentials through Kubernetes Secrets, and restricting PostgreSQL to an internal service in both the Helm chart and Docker Compose deployment. OpenLDAP is also restricted to an internal service. The predefined users intended for development and testing are retained, but the documentation now explicitly warns that their default credentials must not be used in production and that these users should be removed or their credentials changed after installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the Helm chart defaults so the Keycloak service and its PostgreSQL backing database are not exposed via Kubernetes NodePort services by default.
Helm chart (Keycloak service exposure) service type / exposure = restricted (no NodePort by default) - Configuration
Restrict PostgreSQL to an internal service in the Helm chart configuration (no public exposure).
Helm chart (PostgreSQL service exposure) service exposure = internal-only (restricted to internal service) - Configuration
Update Docker Compose so PostgreSQL is not exposed on all network interfaces; restrict access so PostgreSQL is reachable only internally.
Docker Compose (PostgreSQL exposure) network interfaces binding = not bound to all network interfaces - Configuration
Configure the Helm chart to generate a random Keycloak administrator password by default instead of using fixed default credentials.
Helm chart (Keycloak administrator password) Keycloak admin password = random (generated by default) - Configuration
Manage Keycloak and PostgreSQL credentials via Kubernetes Secrets rather than using fixed default credentials or insecure inline configuration.
Helm chart (Keycloak credentials management) credentials storage = Kubernetes Secrets - Configuration
Use appropriate secret management for Keycloak and PostgreSQL credentials (the issue was addressed by managing both through Kubernetes Secrets in the Helm chart and by restricting exposure); remove fixed default credentials from Docker Compose.
Docker Compose (PostgreSQL credentials management) credentials storage = Kubernetes Secrets (if applicable) / secure secret management - Configuration
Restrict OpenLDAP access so it is only available as an internal service.
OpenLDAP network access scope = internal-only (restricted to an internal service) - Operational
After installation, remove the predefined development/testing users intended for development and testing, or change their default credentials; ensure operators are explicitly warned not to use their default credentials in production.
Event History
Frequently Asked Questions
Which deployments are exposed by default?
The affected Helm chart exposed Keycloak and its PostgreSQL backing database through Kubernetes NodePort services by default. The Docker Compose deployment exposed PostgreSQL on all network interfaces.
What does an attacker need to exploit this issue?
An attacker must be able to reach the exposed Keycloak or PostgreSQL service and use the published fixed default credentials. No official Eclipse aeriOS release had been published for the affected development version.
What access could an attacker obtain?
The default Keycloak administrator credentials could provide administrative access to the Identity Manager, while the PostgreSQL credentials could provide direct database access. This may permit access to or modification of users, roles, client credentials, sessions, and other identity-management data.
Are non-default credentials and secret handling relevant to exposure?
Yes. The deployment used fixed default credentials for the Keycloak administrator and PostgreSQL user, and the previous Helm chart did not provide adequate secret management for them. Predefined development and testing application users also had known credentials without sufficient production-use warnings.