CVE-2026-77524: KEDA Privilege Escalation via TriggerAuthentication
Summary
CVE-2026-77524: KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication. Affects github.com/kedacore/keda versions < 1.5.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
KEDA (Kubernetes Event-driven Autoscaling) is an open-source project that allows Kubernetes to scale applications based on external events. It provides a way to define scaling behavior using custom resources like TriggerAuthentication and ScaledObject. This vulnerability affects KEDA versions up to 2.20.0, where a namespace admin can exploit the system to gain cluster admin privileges.
Vulnerability Detail
The vulnerability arises from a flaw in the KEDA operator's handling of TriggerAuthentication resources. A namespace admin can create a TriggerAuthentication that directs the KEDA operator to send its own ServiceAccount token to a URL controlled by the attacker. This token grants extensive permissions, including reading all Secrets across namespaces and creating or deleting jobs and horizontal pod autoscalers. The issue is compounded by the fact that the destination URL is not validated, allowing attackers to hijack the operator's identity and escalate their privileges from a namespace admin to a cluster admin.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict the permissions of namespace admins to prevent them from creating TriggerAuthentication and ScaledObject resources until the KEDA operator is updated.
Conclusion
The CVE-2026-77524 vulnerability in KEDA allows namespace admins to escalate their privileges to cluster admin through a misconfigured TriggerAuthentication. It is critical to update to version 2.21.0 or later to mitigate this risk and ensure the security of your Kubernetes environment.
See every vulnerability recorded for github.com/kedacore/keda →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
An attacker can escalate privileges to cluster admin, allowing them to read all Secrets and create workloads across the cluster, which poses a significant security risk.
Yes, you can restrict the permissions of namespace admins to prevent them from creating TriggerAuthentication and ScaledObject resources.
KEDA is an open-source project that enables Kubernetes to scale applications based on external events, making it crucial for efficient resource management in cloud-native environments.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/kedacore/keda.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
