CLEANSTART-2026-UH53082: Security fix for GHSA-gcjh-h69q-9w9g applied in: keda 2.19.0-r5, keda 2.19.0-r6

Q: Which keda package releases contain the security fix?

The fix is applied in keda 2.19.0-r5 and keda 2.19.0-r6. The issue is resolved in later releases as well.

Q: Is network access required to exploit this issue?

Yes. The vector is network-based (AV:N), and the attack complexity is low (AC:L). No privileges or user interaction are required, but exploitation depends on an additional condition (AT:P).

Q: What is the expected impact if exploitation succeeds?

The reported impact is limited confidentiality impact (VC:L). No integrity or availability impact is indicated for either the vulnerable component or subsequent systems.

Published Nov 11, 2026

Updated

Security vulnerability affects the keda package. This issue is resolved in later releases. See references for vulnerability details.

Affected Software

1 affected componentFixes available

cleanstart/keda<2.19.0-r5

2.19.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/keda to a version that resolves this vulnerability.
Fixed in 2.19.0-r5
Upgrade
Upgrade cleanstart/keda to a version that resolves this vulnerability.
Fixed in 2.19.0-r6
Upgrade
Upgrade keda to a version that resolves this vulnerability.
Fixed in 2.19.0-r5
Upgrade
Upgrade keda to a version that resolves this vulnerability.
Fixed in 2.19.0-r6

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

GHSA-gcjh-h69q-9w9g

Frequently Asked Questions

Which keda package releases contain the security fix?

The fix is applied in keda 2.19.0-r5 and keda 2.19.0-r6. The issue is resolved in later releases as well.

Is network access required to exploit this issue?

Yes. The vector is network-based (AV:N), and the attack complexity is low (AC:L). No privileges or user interaction are required, but exploitation depends on an additional condition (AT:P).

What is the expected impact if exploitation succeeds?

The reported impact is limited confidentiality impact (VC:L). No integrity or availability impact is indicated for either the vulnerable component or subsequent systems.

CLEANSTART-2026-UH53082: Security fix for GHSA-gcjh-h69q-9w9g applied in: keda 2.19.0-r5, keda 2.19.0-r6

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which keda package releases contain the security fix?

Is network access required to exploit this issue?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which keda package releases contain the security fix?

Is network access required to exploit this issue?

What is the expected impact if exploitation succeeds?