CVE-2026-77524

CriticalCVSS 9.9/10Last modified Oct 20, 2026

Description

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 20, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-775254.2MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationCVE-2026-775285.3Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints thCVE-2026-77536.5The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check onCVE-2026-775328.8A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwiCVE-2026-775339.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtCVE-2026-775349.9A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain deviCVE-2026-775359.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi NetCVE-2026-775369.9A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain deviCVE-2026-7753710.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to CVE-2026-775388.2A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to esCVE-2026-775399.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-77546.5IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration an