CVE-2026-77524
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ["*"]/["*"] get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs and horizontalpodautoscalers create/delete cluster-wide, */scale update on any workload,…
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.64% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- github.com/kedacore/keda (go) <= 1.5.0, no fix yet · GHSA-637c-6jxx-4rwm
- github.com/kedacore/keda/v2 (go) < 2.21.0, fixed in 2.21.0 · GHSA-637c-6jxx-4rwm