Read the docs
TI-2025-42006 Aliases CVE-2025-68476GHSA-c4p6-qg4m-9jmr

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Priority MEDIUM 43CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22, CWE-863 and the CVSS impact.

Summary

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00626 50th percentileScored 2026-11-07
Fix Partial keda (kedacore): 2.17.3, 2.18.3github.com/kedacore/keda/v2 (Go): 2.18.3, 2.17.3Red Hat: 4 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kedacorekedabefore 2.17.3; 2.18.0 to before 2.18.32.17.3, 2.18.3Patch availableCNA
—github.com/kedacore/keda/v2 (Go)2.18.0 to before 2.18.32.18.3Patch availableGHSA-c4p6-qg4m-9jmr
—github.com/kedacore/keda/v2 (Go)before 2.17.32.17.3Patch availableGHSA-c4p6-qg4m-9jmr
  • keda Vendorkedacore Affected before 2.17.3; 2.18.0 to before 2.18.3 Fixed in 2.17.3, 2.18.3 Patch available CNA
  • github.com/kedacore/keda/v2 (Go) Vendor— Affected 2.18.0 to before 2.18.3 Fixed in 2.18.3 Patch available GHSA-c4p6-qg4m-9jmr
  • github.com/kedacore/keda/v2 (Go) Vendor— Affected before 2.17.3 Fixed in 2.17.3 Patch available GHSA-c4p6-qg4m-9jmr

Remediation

  • Fix · CNA keda (kedacore) Fixed in 2.17.3, 2.18.3
  • Fix · GHSA-c4p6-qg4m-9jmr github.com/kedacore/keda/v2 (Go) Fixed in 2.18.3 Advisory →
  • Fix · GHSA-c4p6-qg4m-9jmr github.com/kedacore/keda/v2 (Go) Fixed in 2.17.3 Advisory →

Red Hat 4 advisories

  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:2695 Released 2026-02-12 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
  • RHSA-2026:2368 Released 2026-02-09 · Red Hat rating Important
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.18.1-2 Update
    • Custom Metric Autoscaler operator for Red Hat Openshift 2.18 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
Show 1 more Red Hat advisories
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Deployment Validation OperatorAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Custom Metric Autoscaler operator for Red Hat Openshift 2.18Fixed RHSA-2026:2368
Red Hat OpenShift AI 2.25Fixed RHSA-2026:2106, RHSA-2026:2695
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Not affected: 5 products
  • Custom Metric Autoscaler operator for Red Hat Openshift 2.18
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68476
  2. 2026-10-03 Alias added: GHSA-c4p6-qg4m-9jmr
  3. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 3

  • TI-2026-74325 Privilege escalation in KEDA lets namespace admins gain cluster admin CVSS 3.1CRITICAL 9.9
  • TI-2026-38635 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences