PatchSiren

defenseunicorns CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL defenseunicorns CVE published 2026-06-05

CVE-2026-46389

CVE-2026-46389 is a CRITICAL vulnerability in UDS Identity Config's Keycloak configuration image. A logic error in the `client-kubernetes-secret` Keycloak client authenticator, shipped by `uds-identity-config` and consumed by UDS Core, causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. This allows an attacker who can reach the Keycloak token endpoi [truncated]