VulnSocial

CVE-2026-46389Disclosure(defenseunicorns / uds_identity_config)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch defenseunicorns uds_identity_config systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.

defenseunicorns CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-287CWE-303

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • uds_identity_config

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-06-06); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
defenseunicorns
Products
uds_identity_config

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-06-06: 3Mentions · 2026-06-09: 1PoC Mentioned / Linked · 2026-06-09: 1Patch / Workaround · 2026-06-06: 1Technical Details · 2026-06-06: 1Technical Details · 2026-06-09: 106-0606-09
Signal classification4 categories
Disclosure
125.0%
General
125.0%
Patch
125.0%
Exploit
125.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-063
Disclosure1General1Patch1
2026-06-091
Exploit1
Full discourse4 posts
  • Kaitan ID Security@KaitanSecurity
    Exploit

    ⚠️ CVE of the week — CVE-2026-46389 (CVSS 10.0) · NVD/NIST 💣 Exploit available https://sec.kaitan.id/cves/CVE-2026-46389?utm_source=x&utm_campaign=tuesday_highlight 📬 Weekly recap → https://sec.kaitan.id/blog #cybersecurity #cve #vulnmanagement #kaitanid https://t.co/aYMKN1SNez

    Post summary

    The tweet highlights CVE‑2026‑46389 (CVSS 10.0) and indicates that exploit code is available via the provided link, with no mention of active attacks, patches, or false‑positive status.

    0000024
    82 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    Critical (CVSS 10): CVE-2026-46389 in UDS Identity Config allows client auth bypass via a logic error in `ClientIdAndKubernetesSecretAuthenticator`. Affects v0.11.0-0.26.0. Unauthenticated, network-exploitable. Upgrade to v0.26.1 now. https://secalerts.co/vulnerability/CVE-2026-46389 https://t.co/gIpJCkD7AR

    Post summary

    The tweet informs users of CVE-2026-46389, details an authentication bypass vulnerability, and recommends upgrading to v0.26.1 to remediate the flaw.

    00000119
    831 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 t… https://www.cve.org/CVERecord?id=CVE-2026-46389 ----- Traducción: CVE-2026-46389 UDS… http://infoflow.cloud`

    Post summary

    A brief notice of CVE‑2026‑46389 with a link to its CVE record, lacking additional exploit, mitigation, or technical details.

    0000035
    79 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 t… https://www.cve.org/CVERecord?id=CVE-2026-46389

    Post summary

    The text references CVE-2026-46389 but provides no actionable details, PoC, exploit, or patch information.

    00000231
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appdefenseunicornsuds_identity_config---

Explore more

Back to dashboarddefenseunicorns CVEsuds_identity_config vulnerabilities