Deployments of version 2.2.0 of the aas-basyx-v2-full Helm chart that enable the bundled Keycloak store the client secret of the "basyx-technical-user" OAuth2 client in cleartext within a Kubernetes ConfigMap. The secret is also inserted into a realm‑import JSON that the chart creates, resulting in the same value appearing in a public ConfigMap. A principal that can view ConfigMaps but does not possess access to Secrets, such as a member of the built‑in "view" ClusterRole, can read the secret. By exchanging that secret at the Keycloak token endpoint, an attacker can obtain an access token bearing the realm administrator role, which grants full create, read, update, delete and execute permissions on all BaSyx repositories and registries.

Eclipse Foundation’s Eclipse BaSyx Helm Charts, specifically the aas-basyx-v2-full chart version 2.2.0, which bundles Keycloak. No fixed release of this chart exists; users must migrate to the non‑bundled basyx chart or deploy without the bundled Keycloak.

The vulnerability is a cleartext credential exposure (CWE‑312) combined with inadequate privilege separation (CWE‑522). The CVSS score of 7.5 reflects the high impact of obtaining an admin token with only read‑only ConfigMap access. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploitation yet. An attacker with the built‑in "view" ClusterRole can read the exposed secret and exchange it for an administrative token, enabling unrestricted operations against the BaSyx APIs.