{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/keda-operator--2.20.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kedacore:keda:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-77524"},{"id":"CVE-2025-68476"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["keda-operator (\u003c= 2.20.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["KEDA"],"content_html":"\u003cp\u003eKEDA version 2.20.0 and earlier contains a critical vulnerability (CVE-2026-77524) that allows a namespace-level administrator to escalate privileges to cluster-admin. The issue resides in how the \u003ccode\u003eTriggerAuthentication\u003c/code\u003e resource processes HashiCorp Vault authentication requests. Because the destination address for Vault is user-controlled and remains unvalidated, an attacker can point the KEDA operator to a malicious, tenant-controlled server. When the operator attempts to authenticate, it incorrectly defaults to using its own highly-privileged ServiceAccount token. The existing content filter, designed to mitigate CVE-2025-68476, merely verifies that the credential appears to be a Kubernetes JWT, which the operator's own token satisfies. Consequently, the operator sends its token to the attacker, providing the tenant with full cluster-wide permissions, including reading all Secrets and deploying arbitrary jobs across the entire cluster.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker, possessing namespace-admin rights, deploys a listener service within their namespace designed to capture HTTP request bodies and impersonate a HashiCorp Vault server.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a \u003ccode\u003eTriggerAuthentication\u003c/code\u003e custom resource, setting the \u003ccode\u003ehashiCorpVault.address\u003c/code\u003e field to the URI of the malicious listener.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a \u003ccode\u003eScaledObject\u003c/code\u003e in their namespace and references the \u003ccode\u003eTriggerAuthentication\u003c/code\u003e resource in the \u003ccode\u003eauthenticationRef\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eThe KEDA operator reconciles the \u003ccode\u003eScaledObject\u003c/code\u003e and triggers the authentication workflow against the attacker's listener.\u003c/li\u003e\n\u003cli\u003eThe KEDA operator sends its internal ServiceAccount token (authenticated as \u003ccode\u003ekeda-operator\u003c/code\u003e) within an HTTP request body to the listener.\u003c/li\u003e\n\u003cli\u003eThe attacker captures the raw ServiceAccount token from the listener logs.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the exfiltrated ServiceAccount token to authenticate to the Kubernetes API, granting cluster-wide read/write permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker performs impact activities, such as exfiltrating cluster-wide secrets or executing arbitrary jobs in sensitive namespaces (e.g., \u003ccode\u003ekube-system\u003c/code\u003e).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for complete cluster compromise. Successful exploitation grants an attacker the permissions of the \u003ccode\u003ekeda-operator\u003c/code\u003e ServiceAccount, which includes full cluster-wide access to secrets, the ability to modify admission configurations, and the privilege to create or delete workloads across all namespaces. This facilitates unauthorized data access and persistence across the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to KEDA 2.21.0 or later immediately to address CVE-2026-77524.\u003c/li\u003e\n\u003cli\u003eAudit Kubernetes RBAC roles in multi-tenant environments to restrict the ability to create or modify \u003ccode\u003eTriggerAuthentication\u003c/code\u003e and \u003ccode\u003eScaledObject\u003c/code\u003e resources to trusted principals only.\u003c/li\u003e\n\u003cli\u003eMonitor cluster API access logs for anomalous usage of the \u003ccode\u003ekeda-operator\u003c/code\u003e ServiceAccount, specifically focusing on cross-namespace secret access or job creation by unauthorized users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:22:51Z","date_published":"2026-10-15T22:22:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-keda-privilege-escalation/","summary":"A namespace-level administrator can manipulate the KEDA operator to send its highly-privileged cluster ServiceAccount token to a tenant-controlled destination, resulting in full cluster-wide privilege escalation.","title":"KEDA Privilege Escalation via TriggerAuthentication","url":"https://feed.craftedsignal.io/briefs/2026-10-keda-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Keda-Operator (\u003c= 2.20.0)","version":"https://jsonfeed.org/version/1.1"}