CVE-2026-46389: UDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`

Synopsis

An authentication bypass vulnerability exists in the `ClientIdAndKubernetesSecretAuthenticator` component of UDS Identity Config, a package that builds the Keycloak configuration image used by UDS Core. The flaw is reachable over the network with no credentials required, and stems from a logic error that overwrites the submitted client secret with the mounted Kubernetes secret before comparison, effectively accepting any secret value. Successful exploitation lets an attacker obtain OAuth2 tokens scoped to the targeted client's service account, and in the case of the `uds-operator` client, read and modify other registered OAuth2 clients. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Keycloak token endpoint over the network; no foothold on the host is required.

• AuthenticationNot required

  No credentials are needed prior to exploitation; the vulnerability is the mechanism that would otherwise enforce authentication.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted token request directly to the service.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring only a reachable token endpoint and a known client_id that uses the vulnerable authenticator.

Blast Radius

• Attacker obtains valid OAuth2 access tokens scoped to any targeted client service account that uses the `client-kubernetes-secret` authenticator.
• If the `uds-operator` client is targeted, the attacker gains the ability to read and modify other registered OAuth2 clients in the Keycloak realm.
• Any service account permissions bound to a compromised client token are accessible, which may include downstream API calls, secrets access, or cluster-level operations depending on the deployment.
• Full confidentiality, integrity, and availability of the identity plane are at risk given the CVSS C:H/I:H/A:H rating and the cross-scope (S:C) propagation.