Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77524: KEDA lets namespace admin gain cluster admin rights

CVE-2026-77524 · published 1 day ago

Summary

If a user with admin rights in a single namespace creates certain KEDA objects, they can cause KEDA to send its own high‑privilege token to an external address. That token can read all secrets and create or modify resources across the whole cluster, effectively turning a namespace admin into a cluster admin. Upgrade KEDA to a version that blocks this behavior or remove the ability for untrusted users to create TriggerAuthentication and ScaledObject resources.

What to do

Update github.com kedacore to version 2.21.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	kedacore	keda	< 2.21.0
go	github.com	kedacore	<= 1.5.0
go	github.com	kedacore	< 2.21.0 Fix: upgrade to 2.21.0

Original advisory text

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

References

https://github.com/kedacore/keda/security/advisories/GHSA-637c-6jxx-4rwm Vendor Advisory
https://github.com/kedacore/keda/commit/1e21cc798dedd079e696cdb45388eddc5e18365d Patch
https://github.com/kedacore/keda/releases/tag/v2.21.0 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77524... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-77524 Vendor Advisory
https://github.com/advisories/GHSA-637c-6jxx-4rwm

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published14 Oct 2026

Updated16 Oct 2026

First seen14 Oct 2026

Sources

CVE-2026-77524 · NVD

CVE-2026-77524 · MITRE

CVE-2026-77524 · OSV

GHSA-637c-6jxx-4rwm · GHSA

Track software like this

Free during beta