Vulnerabilities

Eclipse aeriOS Ships With Default Credentials and a 9.9 Security Flaw

September 9, 2026

3 mins

The Mess: Eclipse aeriOS exposed Keycloak and PostgreSQL with insecure defaults, including fixed credentials. CVE-2026-86464 carries a CVSS 9.9 score.
The Damage: An attacker who can reach the exposed services can take over the Identity Manager or directly access its database.
The Fix: Pull the affected development version, apply the upstream fixes, rotate every credential and keep Keycloak, PostgreSQL and OpenLDAP off public network interfaces.

Kubernetes is very good at making infrastructure easy to deploy.

It is also very good at making a bad deployment repeatable.

CVE-2026-86464 affects the development version of Eclipse aeriOS Identity Manager and carries a CVSS 4.0 score of 9.9 Critical. The problem is a collection of insecure defaults rather than a single memory-corruption bug.

The affected Helm deployment exposed both Keycloak and its PostgreSQL backend through Kubernetes NodePort services. The Docker Compose configuration could expose PostgreSQL on all network interfaces. Worse, the deployment included fixed credentials for the Keycloak administrator and PostgreSQL user.

There were also predefined application accounts intended for development and testing with known credentials.

That creates a remarkably clean attack path:

reach the service → use known credentials → take over IdM

The attacker does not need to exploit a complicated parser.

They just need network access and credentials that should never have survived into an exposed deployment.

The potential impact is serious because this is an Identity Manager. Compromise can expose or modify users, roles, client credentials, sessions and cryptographic material. Attackers could potentially create privileged identities or tokens accepted by other aeriOS components.

The CVSS vector reflects the danger: network attack, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact.

There is an important caveat.

Eclipse aeriOS had no official release at the time of disclosure. The vulnerable code was in the current development version. That makes this less of an emergency for ordinary enterprise users and more of a warning for developers experimenting with the project.

The upstream changes address the problem by generating a random Keycloak administrator password, moving Keycloak and PostgreSQL credentials into Kubernetes Secrets, and restricting PostgreSQL and OpenLDAP to internal services.

The development accounts still exist, but the documentation now explicitly warns that their default credentials must not be used in production and should be removed or changed after deployment.

That should have been the default from day one.

Bugstoday Opinion

A CVSS 9.9 vulnerability caused by default credentials and services exposed by default is almost painfully predictable.

Nobody needs a zero-day when the password is already in the deployment.

The interesting lesson here is not about aeriOS alone. Kubernetes can deploy a beautifully engineered identity stack in seconds — including every bad security decision baked into its Helm chart.

Secrets belong in Secrets. Databases belong on internal networks. Default passwords belong nowhere.

Especially in an identity system.

Today’s Bugs. Tomorrow’s Breaches.