Read the docs
TI-2026-74325 Aliases CVE-2026-77524GHSA-637c-6jxx-4rwm

Privilege escalation in KEDA lets namespace admins gain cluster admin

Priority HIGH 76CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

KEDA 2.20.2 and earlier lets a namespace administrator obtain the operator's Kubernetes ServiceAccount token, a flaw caused by improper privilege management (CWE-269). A user who can create TriggerAuthentication and ScaledObject resources sets the Vault address to an endpoint they control, and KEDA sends the operator's projected token to it as a Vault login. The attacker reuses that token to gain the operator's cluster-wide permissions, including broad Secret reads.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-08
Fix Partial keda (kedacore): 2.21.0github.com/kedacore/keda/v2 (Go): 2.21.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kedacorekedabefore 2.21.02.21.0Patch availableCNA
—github.com/kedacore/keda (Go)up to 1.5.0—No fix listedGHSA-637c-6jxx-4rwm
—github.com/kedacore/keda/v2 (Go)before 2.21.02.21.0Patch availableGHSA-637c-6jxx-4rwm
  • keda Vendorkedacore Affected before 2.21.0 Fixed in 2.21.0 Patch available CNA
  • github.com/kedacore/keda (Go) Vendor— Affected up to 1.5.0 Fixed in — No fix listed GHSA-637c-6jxx-4rwm
  • github.com/kedacore/keda/v2 (Go) Vendor— Affected before 2.21.0 Fixed in 2.21.0 Patch available GHSA-637c-6jxx-4rwm

Remediation

Update github.com/kedacore/keda/v2 to 2.21.0, which fixes the flaw. The sources list no fixed version for keda. Red Hat rates this Important and lists Custom Metric Autoscaler operator for Red Hat Openshift as affected with a plan of none_available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA keda (kedacore) Fixed in 2.21.0
  • Fix · GHSA-637c-6jxx-4rwm github.com/kedacore/keda/v2 (Go) Fixed in 2.21.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix yet
Not affected: 4 products
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • OpenShift Serverless
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-77524
  2. 2026-10-16 Alias added: GHSA-637c-6jxx-4rwm
  3. 2026-10-16 Fix available: Go/github.com/kedacore/keda/[email protected] · GHSA-637c-6jxx-4rwm
  4. 2026-10-16 CVSS score added · GHSA-637c-6jxx-4rwm
  5. 2026-10-16 Weakness changed · GHSA-637c-6jxx-4rwm
  6. 2026-10-16 5 new references · GHSA-637c-6jxx-4rwm
  7. 2026-10-16 Affected versions changed · Red Hat
  8. 2026-10-16 CVSS score added · Red Hat
  9. 2026-10-20 CISA SSVC decision points changed
  10. 2026-10-20 Priority changed: MEDIUM → HIGH
  11. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-38635 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping CVSS 3.1MEDIUM 5.9
  • TI-2025-42006 KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences