Answer in brief
CVE-2026-77524 records a Critical severity (CVSS 9.9) vulnerability in KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication. The current sources do not mark it as known exploited. The current feed maps kedacore/keda (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps kedacore/keda (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| kedacore/kedageneric | <2.21.0 | 2.21.0 |
Published upstream
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 14, 2026
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.
Quoted source text, attributed separately from HOL analysis.