CVE-2026-77524

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass in KEDA via Vault Impersonation

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77524

EUVD

EUVD-2026-101431

Affected Vendors & Products

Vendor	Product	Version / Range
kedacore	keda	< 2.21.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-77524 is a critical privilege escalation vulnerability in KEDA versions 2.20.2 and earlier. A namespace administrator can create TriggerAuthentication and ScaledObject resources to set a tenant-controlled Vault endpoint and select Kubernetes authentication without explicit credentials. KEDA then sends the operator pod's ServiceAccount token to this endpoint, granting the attacker cluster-wide permissions including Secret reads and workload operations.

Detection Guidance

Check KEDA version with 'kubectl get deployment -n keda keda-operator -o jsonpath='{.spec.template.spec.containers[0].image}'' to see if it is below 2.21.0. Inspect TriggerAuthentication and ScaledObject resources for suspicious Vault address configurations using 'kubectl get triggerauthentications,clustertriggerauthentications -A -o yaml' and 'kubectl get scaledobjects -A -o yaml'.

Impact Analysis

An attacker with namespace admin access could escalate privileges to cluster admin, read all Secrets across namespaces, create/delete batch jobs cluster-wide, update workloads, modify validating webhook configurations, and hijack API routing. This requires the ability to create TriggerAuthentication and ScaledObject resources.

Compliance Impact

This vulnerability allows a namespace administrator to escalate privileges to cluster admin level, enabling unauthorized access to all Secrets across namespaces, workload manipulation, and API routing hijacking. Such broad unauthorized access could lead to exposure of sensitive personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade KEDA to version 2.21.0 or later immediately. Review and update TriggerAuthentication resources to remove tenant-controlled Vault endpoints. Enable enforce-audience mode and configure approved audiences via KEDA_SERVICE_ACCOUNT_TOKEN_AUDIENCES. Set HashicorpVault.address validation to enforce mode to block untrusted destinations.

Hi! I’m here to help you understand CVE-2026-77524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70