---
id: "CVE-2026-77524"
kind: "vulnerability"
aliases: ["CVE-2026-77524", "GHSA-637c-6jxx-4rwm", "GO-2026-6776"]
title: "KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda"
severity: "critical"
cvss: 9.9
epss: 0.00635
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/kedacore/keda", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/kedacore/keda/v2", "fixed": ["2.21.0"], "affected": "< 2.21.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "keda", "kubernetes", "multi-tenant-clusters", "package"]
not_affected_if: ["keda-2.21.0-or-later", "no-hashicorp-vault-triggers", "single-tenant-clusters"]
published_at: "2026-10-14T17:19:11+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:50:16+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6776", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77524", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77524", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda

KEDA 2.20.2 and earlier let a namespace admin who can create TriggerAuthentication and ScaledObject resources point a Vault address at an attacker-controlled endpoint, and KEDA then sends the operator pod's ServiceAccount token to it as a Vault login. The stolen token carries the operator's cluster-wide permissions, including broad Secret reads, so the attacker can escalate from namespace admin to cluster admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/kedacore/keda affected all versions fixed ?
- go:github.com/kedacore/keda/v2 affected < 2.21.0 fixed 2.21.0

## How to check

Look for TriggerAuthentication resources that set hashiCorpVault.address with Kubernetes auth and no explicit credential, and check who can create TriggerAuthentication and ScaledObject resources in each namespace.
Check the deployed KEDA operator version; 2.20.2 and earlier are affected.
How to read the version from the running operator: unknown.

## Fix

Upgrade github.com/kedacore/keda/v2 and the KEDA operator to 2.21.0 or later.
Until upgraded, restrict who can create TriggerAuthentication and ScaledObject resources.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6776
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77524
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77524

## From the sources

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_