{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "kedacore keda: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/kedacore--keda/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/kedacore--keda/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77524/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77524/",
   "title": "CVE-2026-77524 disclosed",
   "content_text": "KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.",
   "date_published": "2026-10-14T16:15:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77524/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77524/",
   "title": "CVE-2026-77524 fixed in Chainguard",
   "content_text": "Fixed versions: k8sgpt 0.4.40-r3, keda-http-add-on-interceptor 0.16.0-r4, keda-http-add-on-interceptor-fips 0.16.0-r4, keda-http-add-on-operator 0.16.0-r4, keda-http-add-on-operator-fips 0.16.0-r4, keda-http-add-on-scaler 0.16.0-r4, keda-http-add-on-scaler-fips 0.16.0-r4, kserve-agent 0.21.0-r7, kserve-agent-fips 0.21.0-r4, kserve-llmisvc-controller 0.21.0-r7, kserve-llmisvc-controller-fips 0.21.0-r4, kserve-localmodel 0.21.0-r7, kserve-localmodelnode-agent 0.21.0-r4, kserve-localmodelnode-agent-fips 0.21.0-r5, kserve-manager 0.21.0-r7, kserve-manager-fips 0.21.0-r4, kserve-router 0.21.0-r7, kserve-router-fips 0.21.0-r4.",
   "date_published": "2026-10-14T16:15:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77524/fixed/go",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77524/",
   "title": "CVE-2026-77524 fixed upstream (Go)",
   "content_text": "Fixed versions: github.com/kedacore/keda/v2 2.21.0.",
   "date_published": "2026-10-14T16:15:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-77524/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-77524/",
   "title": "CVE-2026-77524 fixed in Wolfi",
   "content_text": "Fixed versions: k8sgpt 0.4.40-r3, kserve-agent 0.21.0-r7, kserve-localmodel 0.21.0-r7, kserve-manager 0.21.0-r7, kserve-router 0.21.0-r7.",
   "date_published": "2026-10-14T16:15:15Z"
  }
 ]
}