CVE-2026-77524: KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KEDAto a version that resolves this vulnerability.Fixed in 2.21.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
A namespace administrator who can create both TriggerAuthentication and ScaledObject resources can exploit it. The attacker does not need direct access to the KEDA operator pod or its ServiceAccount token.
What configuration is required for exploitation?
The attacker configures hashiCorpVault.address to an endpoint they control and selects Kubernetes authentication without an explicit credential. KEDA then sends the operator pod's projected ServiceAccount token to that endpoint as a Vault login credential.
What is the practical impact after token disclosure?
The attacker can use the operator token to obtain the KEDA operator's cluster-wide permissions. The advisory identifies broad Secret-read access and workload- or admission-related operations among the accessible permissions.
How can I determine whether my deployment is affected?
Deployments running KEDA 2.20.2 or earlier are affected if namespace administrators can create TriggerAuthentication and ScaledObject resources. Review those resources for Kubernetes-authenticated HashiCorp Vault configurations whose address points to tenant-controlled or otherwise untrusted endpoints.
What remediation is available?
Upgrade KEDA to version 2.21.0, which fixes the vulnerability. Until upgrading, restrict untrusted namespace administrators from creating TriggerAuthentication and ScaledObject resources, particularly where they can configure HashiCorp Vault addresses and Kubernetes authentication.