CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-77524?
CVE-2026-77524 is a critical vulnerability in kedacore keda, published on 14 Oct 2026.
Official description
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
Which versions are affected by CVE-2026-77524?
6 open source packages ship an affected version, including github.com/kedacore/keda and github.com/kedacore/keda/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kedacore/keda Go | All versions | None |
github.com/kedacore/keda Go | All versions to 1.5.0 | None |
github.com/kedacore/keda Go | All versions to 1.5.0 | None |
github.com/kedacore/keda/v2 Go | All versions | 2.21.0 |
github.com/kedacore/keda/v2 Go | All versions | 2.21.0 |
github.com/kedacore/keda/v2 Go | All versions | 2.21.0 |
How do I fix CVE-2026-77524?
Upgrade to a fixed version.
Is CVE-2026-77524 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77524 exists.
Sources
Also known as AZL-108090, ECHO-3e67-ceec-515b, GHSA-637c-6jxx-4rwm, GO-2026-6776, MINI-27v4-4q64-34r3, MINI-34c3-v8hh-vc5v and 5 more.