CVE-2026-77524
Fixed in a distro release EPSS <1%CVSS 9.9
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
Products: kedacore keda
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kedacore/keda | no fix |
| Go | github.com/kedacore/keda/v2 | 2.21.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | k8sgpt | 0.4.40-r3 |
| Chainguard | keda-2.18 | no fix |
| Chainguard | keda-2.18-admission-webhooks | no fix |
| Chainguard | keda-2.18-metrics-apiserver | no fix |
| Chainguard | keda-2.19 | no fix |
| Chainguard | keda-2.19-admission-webhooks | no fix |
| Chainguard | keda-2.19-metrics-apiserver | no fix |
| Chainguard | keda-2.20 | no fix |
| Chainguard | keda-2.20-admission-webhooks | no fix |
| Chainguard | keda-2.20-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.18 | no fix |
| Chainguard | keda-fips-2.18-admission-webhooks | no fix |
| Chainguard | keda-fips-2.18-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.19 | no fix |
| Chainguard | keda-fips-2.19-admission-webhooks | no fix |
| Chainguard | keda-fips-2.19-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.20 | no fix |
| Chainguard | keda-fips-2.20-admission-webhooks | no fix |
| Chainguard | keda-fips-2.20-metrics-apiserver | no fix |
| Chainguard | keda-http-add-on-interceptor | 0.16.0-r4 |
| Chainguard | keda-http-add-on-interceptor-fips | no fix |
| Chainguard | keda-http-add-on-interceptor-fips | 0.16.0-r4 |
| Chainguard | keda-http-add-on-operator | 0.16.0-r4 |
| Chainguard | keda-http-add-on-operator-fips | 0.16.0-r4 |
| Chainguard | keda-http-add-on-scaler | 0.16.0-r4 |
| Chainguard | keda-http-add-on-scaler-fips | no fix |
| Chainguard | keda-http-add-on-scaler-fips | 0.16.0-r4 |
| Chainguard | kserve-agent | 0.21.0-r7 |
| Chainguard | kserve-agent-fips | 0.21.0-r4 |
| Chainguard | kserve-llmisvc-controller | 0.21.0-r7 |
| Chainguard | kserve-llmisvc-controller-fips | 0.21.0-r4 |
| Chainguard | kserve-localmodel | 0.21.0-r7 |
| Chainguard | kserve-localmodelnode-agent | 0.21.0-r4 |
| Chainguard | kserve-localmodelnode-agent-fips | 0.21.0-r5 |
| Chainguard | kserve-manager | 0.21.0-r7 |
| Chainguard | kserve-manager-fips | 0.21.0-r4 |
| Chainguard | kserve-router | 0.21.0-r7 |
| Chainguard | kserve-router-fips | 0.21.0-r4 |
| Chainguard | verticadb-operator | no fix |
| Chainguard | verticadb-operator-fips | no fix |
| Wolfi | k8sgpt | 0.4.40-r3 |
| Wolfi | keda-2.19 | no fix |
| Wolfi | keda-2.19-admission-webhooks | no fix |
| Wolfi | keda-2.19-metrics-apiserver | no fix |
| Wolfi | keda-2.20 | no fix |
| Wolfi | keda-2.20-admission-webhooks | no fix |
| Wolfi | keda-2.20-metrics-apiserver | no fix |
| Wolfi | kserve-agent | 0.21.0-r7 |
| Wolfi | kserve-localmodel | 0.21.0-r7 |
| Wolfi | kserve-manager | 0.21.0-r7 |
| Wolfi | kserve-router | 0.21.0-r7 |
| Wolfi | verticadb-operator | no fix |