{"id":"CVE-2026-77524","summary":"KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication","details":"KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.","aliases":["GHSA-637c-6jxx-4rwm"],"modified":"2026-10-15T02:47:41.802158671Z","published":"2026-10-14T16:15:15.268Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-269","CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77524.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77524.json"},{"type":"FIX","url":"https://github.com/kedacore/keda/commit/1e21cc798dedd079e696cdb45388eddc5e18365d"},{"type":"WEB","url":"https://github.com/kedacore/keda/releases/tag/v2.21.0"},{"type":"ADVISORY","url":"https://github.com/kedacore/keda/security/advisories/GHSA-637c-6jxx-4rwm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77524"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kedacore/keda","events":[{"introduced":"0"},{"fixed":"626ded5d783108bedf647e20bbc83f8e458e02e4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.21.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v2.20.1","v2.20.0","v2.19.0","v2.18.0","v2.17.0","v2.16.0","v2.15.0","v2.14.0","v2.13.0","v2.12.0","v2.11.0","v2.10.0","v2.8.1","v2.9.1","v2.9.0","v2.8.0","v2.7.1","v2.7.0","v2.6.1","v2.6.0","v2.5.0","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v2.0.0-rc2","v2.0.0-rc","v2.0.0-beta","v1.5.0","v1.4.1","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77524.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}