CVE-2026-77524
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
- CVSS 3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-269, CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-637c-6jxx-4rwm | Go | github.com/kedacore/keda | <=1.5.0 | no fix published |
| GHSA-637c-6jxx-4rwm | Go | github.com/kedacore/keda/v2 | <2.21.0 | 2.21.0 |
| GO-2026-6776 | Go | github.com/kedacore/keda | all versions | no fix published |
| GO-2026-6776 | Go | github.com/kedacore/keda/v2 | <2.21.0 | 2.21.0 |