CPE
A namespace-level administrator can manipulate the KEDA operator to send its highly-privileged cluster ServiceAccount token to a tenant-controlled destination, resulting in full cluster-wide privilege escalation.