Keda
Monthly
A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.
A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.