{"id":"CVE-2026-77524","kind":"vulnerability","aliases":["CVE-2026-77524","GHSA-637c-6jxx-4rwm","GO-2026-6776"],"related":[],"title":"KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda","description":"KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.","summary":"KEDA 2.20.2 and earlier let a namespace admin who can create TriggerAuthentication and ScaledObject resources point a Vault address at an attacker-controlled endpoint, and KEDA then sends the operator pod's ServiceAccount token to it as a Vault login. The stolen token carries the operator's cluster-wide permissions, including broad Secret reads, so the attacker can escalate from namespace admin to cluster admin.","severity":"critical","cvss":9.9,"epss":0.00635,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/kedacore/keda","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/kedacore/keda/v2","fixed":["2.21.0"],"affected":"< 2.21.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","keda","kubernetes","multi-tenant-clusters","package"],"not_affected_if":["keda-2.21.0-or-later","no-hashicorp-vault-triggers","single-tenant-clusters"],"how_to_check":"Look for TriggerAuthentication resources that set hashiCorpVault.address with Kubernetes auth and no explicit credential, and check who can create TriggerAuthentication and ScaledObject resources in each namespace.\nCheck the deployed KEDA operator version; 2.20.2 and earlier are affected.\nHow to read the version from the running operator: unknown.","fix":"Upgrade github.com/kedacore/keda/v2 and the KEDA operator to 2.21.0 or later.\nUntil upgraded, restrict who can create TriggerAuthentication and ScaledObject resources.","status":"open","published_at":"2026-10-14T17:19:11+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:50:16+00:00","updated_at":"2026-10-23T19:50:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:50:16Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/kedacore/keda/v2 and the KEDA operator to 2.21.0 or later.\nUntil upgraded, restrict who can create TriggerAuthentication and ScaledObject resources.","summary":"KEDA 2.20.2 and earlier let a namespace admin who can create TriggerAuthentication and ScaledObject resources point a Vault address at an attacker-controlled endpoint, and KEDA then sends the operator pod's ServiceAccount token to it as a Vault login. The stolen token carries the operator's cluster-wide permissions, including broad Secret reads, so the attacker can escalate from namespace admin to cluster admin.","category":"package","who_cares":["keda","kubernetes","go","multi-tenant-clusters"],"confidence":0.8,"analyst_note":"","how_to_check":"Look for TriggerAuthentication resources that set hashiCorpVault.address with Kubernetes auth and no explicit credential, and check who can create TriggerAuthentication and ScaledObject resources in each namespace.\nCheck the deployed KEDA operator version; 2.20.2 and earlier are affected.\nHow to read the version from the running operator: unknown.","needs_analyst":false,"not_affected_if":["keda-2.21.0-or-later","no-hashicorp-vault-triggers","single-tenant-clusters"],"severity_if_unknown":"critical"},"cost_usd":0.000729,"input_tokens":2353,"output_tokens":988,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':184C '-2026':18A,26A,29A '-6776':27A '-68476':185C '-77524':19A,30A '/kedacore/keda':16A,33A '/kedacore/keda/v2':36A '2.20.2':46B,124C '2.21.0':226C '4rwm':24A '637c':22A '6jxx':23A 'accept':187C 'address':63B 'admin':6A,9A,52B,108B,111B 'administr':129C 'admiss':218C 'admission-rel':217C 'attack':67B,103B,200C 'attacker-control':66B 'authent':149C 'autosc':120C 'base':117C 'broad':98B,211C 'carri':89B 'cluster':8A,43B,94B,110B,207C 'cluster-wid':93B,206C 'compon':121C 'control':68B,144C 'creat':55B,132C 'credenti':153C,174C 'cve':17A,28A,183C 'driven':119C 'earlier':48B,126C 'endpoint':69B,145C,169C 'escal':3A,105B 'event':118C 'explicit':152C 'filter':179C 'fix':224C 'ghsa':21A 'ghsa-637c-6jxx-4rwm':20A 'github.com':15A,32A,35A 'github.com/kedacore/keda':14A,31A 'github.com/kedacore/keda/v2':34A 'go':25A,37B 'hashicorpvault.address':139C 'includ':97B,210C 'jwt':177C 'jwt-shape':176C 'keda':1A,11A,38B,45B,71B,112C,154C 'kubernet':39B,116C,148C,196C 'kubernetes-bas':115C 'let':49B 'login':85B,173C 'multi':41B 'multi-tenant-clust':40B 'namespac':5A,51B,107B,128C 'obtain':202C 'oper':75B,91B,158C,189C,204C,220C 'packag':44B 'permiss':96B,209C 'pod':76B,159C 'point':60B 'prior':182C 'privileg':2A 'project':161C 'read':100B,213C 'relat':219C 'remedi':186C 'resourc':59B,136C 'scaledobject':58B,135C 'secret':99B,212C 'select':147C 'send':73B,165C 'serviceaccount':78B,162C,197C 'set':138C 'shape':178C 'stolen':87B 'subject':193C 'tenant':42B,143C 'tenant-control':142C 'token':79B,88B,163C,190C 'triggerauthent':12A,56B,133C 'use':156C 'vault':62B,84B,172C 'version':123C 'via':10A 'vulner':222C 'wide':95B,208C 'without':150C 'workload':215C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-14T17:19:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6776","url":"https://pkg.go.dev/vuln/GO-2026-6776","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77524","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77524","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77524","severity":null,"published_at":"2026-10-14T17:19:11+00:00","modified_at":"2026-10-20T02:17:11+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}