Vulnpedia
← Search CVEs

CVE-2026-77524

CRITICAL 9.9

Published 2026-10-14 · Last modified 2026-10-20

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

ELEVATED IMPACT

Severe if exploited (CVSS 9.9), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 44th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

9.9CVSS 3.1 · CRITICAL

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Kedacore

Products Keda

Weakness (CWE)

  • CWE-269: : Improper Privilege Management
  • CWE-918: : Server-Side Request Forgery (SSRF)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/kedacore/keda Go

    pkg:golang/github.com/kedacore/keda

    SEMVER range
    • All earlier versions (introduced 0)
    • Last affected version (included): 1.5.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-637c-6jxx-4rwm/GHSA-637c-6jxx-4rwm.json"
  }
}
    GitHub Advisory Database · GHSA-637c-6jxx-4rwm · Updated 2026-10-19T21:40:44.489356801Z
  • github.com/kedacore/keda/v2 Go

    pkg:golang/github.com/kedacore/keda/v2

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 2.21.0
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-637c-6jxx-4rwm/GHSA-637c-6jxx-4rwm.json"
  }
}
    GitHub Advisory Database · GHSA-637c-6jxx-4rwm · Updated 2026-10-19T21:40:44.489356801Z
  • github.com/kedacore/keda Go

    pkg:golang/github.com/kedacore/keda

    SEMVER range
    • All earlier versions (introduced 0)
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6776.json"
  }
}
    Go Vulnerability Database · GO-2026-6776 · Updated 2026-10-19T21:31:49.973645562Z
  • github.com/kedacore/keda/v2 Go

    pkg:golang/github.com/kedacore/keda/v2

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 2.21.0
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6776.json"
  }
}
    Go Vulnerability Database · GO-2026-6776 · Updated 2026-10-19T21:31:49.973645562Z

Vendor product assessments

  • custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known affected

    Vendor assessment for this product only.

    pkg:oci/custom-metrics-autoscaler-rhel9?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    • none available: Affected
    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/custom-metrics-autoscaler-adapter-rhel9?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/custom-metrics-autoscaler-admission-webhooks-rhel9?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9 as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/custom-metrics-autoscaler-http-add-on-interceptor-rhel9?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9 as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/custom-metrics-autoscaler-http-add-on-operator-rhel9?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9 as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/custom-metrics-autoscaler-http-add-on-scaler-rhel9?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator as a component of Custom Metric Autoscaler operator for Red Hat Openshift · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/custom-metrics-autoscaler-rhel9-operator?repository_url=registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • openshift-serverless-1/kn-ekb-dispatcher-rhel9 as a component of OpenShift Serverless · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/kn-ekb-dispatcher-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-ekb-dispatcher-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • openshift-serverless-1/kn-ekb-receiver-rhel9 as a component of OpenShift Serverless · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/kn-ekb-receiver-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-ekb-receiver-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-kserve-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-kserve-agent-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-kserve-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-kserve-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-controller-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-kserve-llmisvc-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-kserve-llmisvc-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-llmisvc-controller-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-kserve-localmodel-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-kserve-localmodel-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-localmodel-controller-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-kserve-localmodelnode-agent-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-kserve-localmodelnode-agent-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-localmodelnode-agent-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-kserve-router-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-kserve-router-rhel9?repository_url=registry.redhat.io/rhoai/odh-kserve-router-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-maas-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-maas-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-maas-controller-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-model-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-model-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-model-controller-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-model-registry-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-model-registry-rhel9?repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-model-serving-api-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-model-serving-api-rhel9?repository_url=registry.redhat.io/rhoai/odh-model-serving-api-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-ta-lmes-driver-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-ta-lmes-driver-rhel9?repository_url=registry.redhat.io/rhoai/odh-ta-lmes-driver-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-trustyai-service-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-trustyai-service-operator-rhel9?repository_url=registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • rhoai/odh-workload-variant-autoscaler-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odh-workload-variant-autoscaler-controller-rhel9?repository_url=registry.redhat.io/rhoai/odh-workload-variant-autoscaler-controller-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • odf4/mcg-cli-rhel9 as a component of Red Hat Openshift Data Foundation 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/mcg-cli-rhel9?repository_url=registry.redhat.io/odf4/mcg-cli-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • odf4/mcg-rhel9-operator as a component of Red Hat Openshift Data Foundation 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/mcg-rhel9-operator?repository_url=registry.redhat.io/odf4/mcg-rhel9-operator

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00
  • odf4/odf-cli-rhel9 as a component of Red Hat Openshift Data Foundation 4 · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:oci/odf-cli-rhel9?repository_url=registry.redhat.io/odf4/odf-cli-rhel9

    Red Hat · CVE-2026-77524 · Updated 2026-10-19T18:42:41+00:00

All CVSS metrics

  • CRITICAL 9.9 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 9.9 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS