Skip to content
OpenAdvisories

Package · Go

github.com/kedacore/keda

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.9
    CVE-2026-77524

    KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

    KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select K…

    kedacore keda github.com/kedacore/keda/v2 github.com/kedacore/keda Go
  • Medium 5.9
    CVE-2026-53572

    KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

    KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreCo…

    kedacore keda github.com/kedacore/keda/v2 github.com/kedacore/keda Go
  • High 8.2
    CVE-2025-68476

    KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

    KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCor…

    kedacore keda github.com/kedacore/keda/v2 github.com/kedacore/keda Go