CVE-2026-77524

Summary

A namespace administrator can escalate privileges by configuring KEDA to use a malicious Vault endpoint that accepts the operator pod's ServiceAccount token, allowing them to gain cluster-wide permissions including secret reads and workload operations.

Exploitability

Easy to exploit for a namespace administrator who can create TriggerAuthentication and ScaledObject resources, requiring only configuration of a malicious Vault address with Kubernetes authentication enabled.

Blast radius

High impact across the entire cluster as attackers can read all secrets, modify workloads, and potentially compromise admission controllers or other sensitive operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to KEDA 2.21.0 or later to fix the vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.