A critical vulnerability in the development version of Eclipse aeriOS exposes administrative interfaces and databases to the network, permitting full unauthorized control over identity management services.

The vulnerability involves the exposure of Keycloak and PostgreSQL services via insecure network configurations and the use of hard-coded default credentials. This allows an unauthenticated attacker to bypass security controls and gain administrative access to the Identity Manager system.

Successful exploitation grants an attacker complete control over the Identity Manager, leading to the potential compromise of all managed user accounts, roles, and session tokens. With a CVSS score of 9.9, this vulnerability poses a catastrophic risk to organizational security, as it allows for the exfiltration of sensitive cryptographic material and the creation of rogue privileged identities.

Immediate Action: Upgrade to commit c6efc450baf912385681198b2477c1ba4e93f91a or later, and ensure that all default credentials are rotated immediately upon deployment.

Proactive Monitoring: Review Kubernetes and network access logs for unauthorized connections to Keycloak or database ports, and audit all identity management configurations for unexpected modifications.

Compensating Controls: Restrict network access to the Identity Manager deployment via firewall rules or Kubernetes network policies to ensure services are not exposed to untrusted interfaces.

Public Exploit Available: Unknown

Given the critical severity of this flaw, administrators must prioritize the update to the remediated version immediately. If the software is currently in a production environment, ensure that all default credentials are purged and that services are isolated from public network access until the update is applied.