GO-2026-6776 vulnerabilities

Vulnerabilities for packages: kserve, kserve-fips, kserve-localmodelnode-agent, keda-http-add-on, kserve-localmodelnode-agent-fips, keda-http-add-on-fips, k8sgpt...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: keda-fips, telegraf, keda, guac, trufflehog-fips, dapr, falcosidekick-fips, krakend-fips, bento, falcosidekick, bento-fips, argo-events-fips, trufflehog, dapr-fips, krakend, argo-events...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: keda, guac, telegraf, bento, argo-events, falcosidekick, trufflehog...

GO-2026-6776 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...

CVE-2026-107325 affecting package keda for versions less than 2.14.1-22

CVE-2026-107325 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-107324 affecting package keda for versions less than 2.14.1-22

CVE-2026-107324 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78663 affecting package keda for versions less than 2.14.1-22

CVE-2026-78663 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78659 affecting package keda for versions less than 2.14.1-22

CVE-2026-78659 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78660 affecting package keda for versions less than 2.14.1-22

CVE-2026-78660 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78669 affecting package keda for versions less than 2.14.1-22

CVE-2026-78669 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-97032 affecting package keda for versions less than 2.14.1-22

CVE-2026-97032 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-77524 vulnerabilities

Vulnerabilities for packages: kserve, kserve-fips, kserve-localmodelnode-agent, keda-http-add-on, kserve-localmodelnode-agent-fips, keda-http-add-on-fips, k8sgpt...

GHSA-637C-6JXX-4RWM vulnerabilities

Vulnerabilities for packages: kserve, kserve-fips, kserve-localmodelnode-agent, keda-http-add-on, kserve-localmodelnode-agent-fips, keda-http-add-on-fips, k8sgpt...

GHSA-637C-6JXX-4RWM KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...

EUVD-2026-101431

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication...

CVE-2026-77524

A flaw was found in KEDA. An authenticated user with permission to create autoscaling resources can configure a HashiCorp Vault endpoint pointing to an attacker-controlled server without providing credentials. KEDA then forwards the operator's internal Kubernetes service account token to that...

AZL-108090 CVE-2026-77524 affecting package keda 2.14.1-19

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-77524

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...